alexmbr

Yes, something like that. Just image in less than 1 minute someone is trying to find several pages that don’t exist
https://yourdomain.com/mylogin.php
https://yourdomain.com/admin.php
https://yourdomain.com/hidenadmin.php
…

1o: is that a registered user? If so, send an email to admin and block him.
2o: detect if those came from the same ip, and if so: Block it!
3o: not from the same ip? Perhaps disable the logging in for an ammout of time?!

Thanks.

Would it be possible for to give a feature suggestion here?

It would be a nice security feature to have, if the plugin detect if too many no existent pages.
Something like: Immediately block IP when attempting to hit non-existent pages above 3 tries.

That is not the right way of hidding the wp-login.php file as well. I hide it, but then I showing to the users. That does not make any sense. If I need to hide the file, it does not make sense, that I show it to the users.

About the blocking part, I change it inside your code to make it work.

if ( $script == '/'.WP_LOGIN_SCRIPT || $script == '/'.WP_SIGNUP_SCRIPT) { // no direct access
		if ($_REQUEST['action'] != 'lostpassword'){
			if (cerber_get_options('wplogin'))	cerber_block_add($wp_cerber->getRemoteIp(),__('Attempt to access','cerber').' '.$script);
			if (cerber_get_options('loginnowp')) cerber_404_page();
		}
	}
    elseif ($script == '/'.WP_XMLRPC_SCRIPT || $script == '/'.WP_TRACKBACK_SCRIPT) { // no direct access
        if ($opt['xmlrpc']) cerber_404_page();
    }

No, they are not same. Only “https://mydomain.com/adminlogin” can take the user to see the admin panel. Also, using that URL, the user won’t be able to see or have acess to the “wp-login.php”. That is the point, right, to hide the wp-login.php.

Anyway, I did set a new “Custom Login URL” and enabled “Block direct access to wp-login.php and return HTTP 404 Not Found Error”. But when I click on the lost password links on my site, it only calls the 404.

Also, if I enabled the “Immediately block IP after any request to wp-login.php” option, whenever I click on the any lost password link, my IP becomes Blocked.

Users can login only by using for example this link: “https://mydomain.com/my-account/”. Even a admin won’t ever go into the Admin area using that login link.
The secretURL (wp-login.php) is for admin logging in only.

With that plugin that showed you, this would be my site:
“https://mydomain.com/clientlogin”
“https://mydomain.com/adminlogin”
“https://mydomain.com/recoverpassword”

But with Cerber this is what I have:
“https://mydomain.com/my-account”
“https://mydomain.com/secretURL”
“https://mydomain.com/secretURL?action=lostpassword”

Well, if I use a “Custom login URL” instead of the default to make it harder for a hacker, changing to something that only I know, but I have the Lost password url, that will reveal that “Custom login URL”. That doesn’t make it too secure.
I change the login to = “https://mydomain.com/secretURL”,so noone knows it, but the user goes and click on the lostpassword, and the url appear as:
https://mydomain.com/secretURL?action=lostpassword. Now the user knows the login secret page.

Well, I tried using this plugin here:

https://www.ads-software.com/plugins/custom-login-url/screenshots/

but enabling the “Disable wp-login.php”, still prevents this other plugin to work. As soon as I disable that option, the Custom plugin works fine.

It would be nice to have those “Custom Lostpassword URL” inside your plugin as well, since it calls the