# Block Login Attempts From Scripts and Command-Line Tools

> Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: login, bots, brute-force
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-block-scripted-login-agents/

## Code

```php
// User agent fragments (lowercase) that are never real browsers.
$wpide_script_agents = array( 'curl/', 'wget/', 'python-requests', 'python-urllib', 'go-http-client', 'libwww-perl', 'java/', 'okhttp', 'httpclient', 'scrapy', 'masscan', 'nikto', 'wpscan' );

add_action( 'login_init', function () use ( $wpide_script_agents ) {
    if ( 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : '' ) ) {
        return;
    }

    $agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? strtolower( sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) ) : '';
    $block = '' === $agent;

    foreach ( $wpide_script_agents as $fragment ) {
        if ( false !== strpos( $agent, $fragment ) ) {
            $block = true;
            break;
        }
    }

    if ( $block ) {
        status_header( 403 );
        nocache_headers();
        exit( 'Forbidden.' );
    }
}, 0 );
```

## Notes

Legitimate apps that log in through wp-login.php with such tools will be blocked too; the REST API and application passwords are not affected.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Block Login Attempts From Scripts and Command-Line Tools" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/