# Reject Login Attempts That Don't Come From Your Login Form

> Refuses login form submissions that are not sent from a page on your own site, which stops many brute-force bots that post straight to wp-login.php.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: login, brute-force, bots
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-login-requires-same-site-form/

## Code

```php
add_action( 'login_init', function () {
    if ( 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : '' ) || empty( $_POST['log'] ) ) {
        return;
    }

    $own    = wp_parse_url( site_url(), PHP_URL_HOST );
    $origin = isset( $_SERVER['HTTP_ORIGIN'] ) ? wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['HTTP_ORIGIN'] ) ), PHP_URL_HOST ) : '';
    $ref    = isset( $_SERVER['HTTP_REFERER'] ) ? wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ), PHP_URL_HOST ) : '';
    $home   = wp_parse_url( home_url(), PHP_URL_HOST );

    if ( in_array( $origin ? $origin : $ref, array( $own, $home ), true ) ) {
        return;
    }

    status_header( 403 );
    wp_die( esc_html__( 'Please log in using the login form on this site.' ), 403 );
}, 1 );
```

## Notes

Browsers send the needed Origin or Referer header automatically; disable the snippet if a mobile app or external form logs users in through wp-login.php.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Reject Login Attempts That Don't Come From Your Login Form" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/