Reject Login Attempts That Don't Come From Your Login Form
Refuses login form submissions that are not sent from a page on your own site, which stops many brute-force bots that post straight to wp-login.php.
Opens WPIDE on
Code
add_action( 'login_init', function () {
if ( 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : '' ) || empty( $_POST['log'] ) ) {
return;
}
$own = wp_parse_url( site_url(), PHP_URL_HOST );
$origin = isset( $_SERVER['HTTP_ORIGIN'] ) ? wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['HTTP_ORIGIN'] ) ), PHP_URL_HOST ) : '';
$ref = isset( $_SERVER['HTTP_REFERER'] ) ? wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) ), PHP_URL_HOST ) : '';
$home = wp_parse_url( home_url(), PHP_URL_HOST );
if ( in_array( $origin ? $origin : $ref, array( $own, $home ), true ) ) {
return;
}
status_header( 403 );
wp_die( esc_html__( 'Please log in using the login form on this site.' ), 403 );
}, 1 );Notes
Browsers send the needed Origin or Referer header automatically; disable the snippet if a mobile app or external form logs users in through wp-login.php.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.