sy2j

bertarecchia,

The location of the wp-register.php file will be in whichever directory WordPress is installed, I would have thought. Mine was in the root folder but if you have WordPress installed so its home page is /BLOG then yes, that’s where wp-register.php should be.

The ‘exit’ command wasn’t in htaccess, it was in my blank wp-register.php. I’m not really good enough with htaccess commands to recommend you do something on my say-so, but I imagine Siteturner’s XML-RPC solution above would work for wp-register.php too.

Hi all, I hope this helps someone. Today I’ve noticed login attempts on two of my WP sites on two different servers, both with this great plugin installed. What I’ve found to be happening is that the attacker has hit mysite.com/wp-register.php (which isn’t in either file system) – this redirects them in the background to mysite.com/my-wps-hide-login-url and gives them the ‘registration disabled’ notice. As a quick fix I’ve created a blank wp-register.php in the root directories and just fired ‘exit;’ in it.

Just thought I’d mention it in case anyone finds it helpful.

Siteturner, you’re spot on. I’ve just found this as the cause this morning too. Good job – hopefully this thread will help others.

I’m having this problem too. It was fine when I started using this plugin (which I really like) but in the past couple of weeks Wordfence has been notifying me of loads of login attempts across several websites. I’ve checked what’s reported here and can’t find any login links on the websites. Any ideas appreciated!

Solution: https://www.ads-software.com/support/topic/264249?replies=1

I knew it’d be simple.

@johnthep2009

Could you be more specific? I’d be really grateful if someone could help me fix this today.

Many thanks.

I’ve got this problem too on 2.8.4 – although as with Pathan the problem only presented itself when transferring a site from localhost to remote server.

Certainly no criticism – it’s a great plugin – hopefully someone can post a solution soon.