Hidden URL gets revealed by hitting wp-register.php

Same thing happens on my site… Would you be able to help me with the htaccess code? I tried the following but it doesn’t do anything (as in, it still redirects).

# BEGIN Block direct access to wp-register.php

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-register.php*
RewriteCond %{HTTP_REFERER} !.*mysite.com.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^https://%{REMOTE_ADDR}/$ [R=301,L]
</IfModule>

# END Block direct access to wp-register.php

Thanks!

I denied all access to wp-register.php, because I haven’t any other users besides myself:

<FilesMatch “\.htaccess|wp-config\.php|wp-register\.php”>
Order allow,deny
Deny from all
</FilesMatch>

Furthermore you should check you regex expressions.

The following line has a strange regex syntax (just leave out the . and *):
RewriteCond %{REQUEST_URI} .wp-register.php*

Same thing with the next line: leave out the .* (try to learn about regex somewhere).

Also the following line is strange. Having a rewrite URL with regex tokens in it is meaningless (leave out the ^ and $):
RewriteRule (.*) ^https://%{REMOTE_ADDR}/$ [R=301,L]

Finally: to check your code, you should POST to wp-register.php with an other website as referer or with an empty user-agent. How do you check? With curl?

• This reply was modified 8 years, 2 months ago by cgzaal.
• This reply was modified 8 years, 2 months ago by cgzaal.
• This reply was modified 8 years, 2 months ago by cgzaal.
• This reply was modified 8 years, 2 months ago by cgzaal.
• This reply was modified 8 years, 2 months ago by cgzaal.
• This reply was modified 8 years, 2 months ago by cgzaal.
• This reply was modified 8 years, 2 months ago by cgzaal.