Block Login Attempts From Scripts and Command-Line Tools
Refuses login, password reset and registration requests sent by tools such as curl, wget, python-requests or empty user agents, which real browsers never use and brute-force scripts often do.
Opens WPIDE on
Code
// User agent fragments (lowercase) that are never real browsers.
$wpide_script_agents = array( 'curl/', 'wget/', 'python-requests', 'python-urllib', 'go-http-client', 'libwww-perl', 'java/', 'okhttp', 'httpclient', 'scrapy', 'masscan', 'nikto', 'wpscan' );
add_action( 'login_init', function () use ( $wpide_script_agents ) {
if ( 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : '' ) ) {
return;
}
$agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? strtolower( sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) ) : '';
$block = '' === $agent;
foreach ( $wpide_script_agents as $fragment ) {
if ( false !== strpos( $agent, $fragment ) ) {
$block = true;
break;
}
}
if ( $block ) {
status_header( 403 );
nocache_headers();
exit( 'Forbidden.' );
}
}, 0 );Notes
Legitimate apps that log in through wp-login.php with such tools will be blocked too; the REST API and application passwords are not affected.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.