Reject Login Attempts for Common Usernames
Refuses login attempts for usernames bots love to try, such as "admin", "administrator" or "root", before WordPress even checks a password.
Opens WPIDE on
Code
// Usernames that can never log in.
$wpide_banned_logins = array( 'admin', 'administrator', 'root', 'test', 'user', 'demo' );
add_filter( 'authenticate', function ( $user, $username ) use ( $wpide_banned_logins ) {
if ( is_string( $username ) && in_array( strtolower( trim( $username ) ), $wpide_banned_logins, true ) ) {
return new WP_Error( 'wpide_banned_login', '<strong>Error:</strong> The username or password you entered is incorrect.' );
}
return $user;
}, 1, 2 );Notes
Make sure none of your real accounts use one of the listed usernames before activating.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.