WP Manifestindependent plugin directory
manifest / security / clearph-hide-login

Clear pH Hide Login self-updates

Hide the WordPress login URL behind a custom slug. In-house plugin for Clear pH Design sites on Flywheel.

by Clear pH Design · github.com/dbreck/clearph-hide-login

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/dbreck/clearph-hide-login/archive/refs/heads/main.zip

Ships its own WordPress updater (Plugin Update Checker), so new versions show up under Dashboard → Updates.

Readme github.com/dbreck/clearph-hide-login ↗

Hide the WordPress login URL behind a custom slug. 404 every hit to wp-login.php and wp-admin while logged out. Manage from wp-admin — no wp-config edits required.

Description

Clear pH Hide Login is an in-house replacement for WPS Hide Login built for Clear pH Design sites on Flywheel (where wp-config.php rewrites are not allowed).

What it does

  • Hides the WordPress login form behind a slug you choose (e.g. /cph-portal-7g3xq).
  • Serves a real 404 (no redirect, no signal) on:
    • wp-login.php
    • wp-register.php, wp-signup.php, wp-activate.php
    • /wp-admin/ for logged-out users
    • /login, /admin, /dashboard shortcut redirects
  • Rewrites every internally generated login link — password-reset emails, logout flows, "you must log in" prompts — to use your custom slug.
  • Optional: kill the lost-password flow entirely. Stops password-reset spam at the source.
  • Optional: log every blocked attempt (IP, UA, request URI, reason).
  • Multisite: network-wide default with per-site override.
  • Compatible with the cph-hidden-login mu-plugin (same option key + slug-resolution chain). If both are installed the mu-plugin wins.

What it does not do

  • No wp-config rewrites. Pure PHP hooks.
  • No bundled translations / i18n.
  • No advertising or upsell notices.

Slug resolution order

  1. CPH_HIDE_LOGIN_SLUG constant
  2. cph_hide_login_slug filter
  3. Site option cph_hide_login_slug
  4. Network option cph_hide_login_slug (multisite default)
  5. Empty → plugin no-ops, default wp-login.php works normally

Installation

  1. Drop the cph-hide-login folder into wp-content/plugins/.
  2. Activate from the Plugins screen.
  3. Go to Settings → Clear pH Hide Login and set a slug.
  4. Bookmark the new login URL.

For multisite: activate network-wide, then go to Network Admin → Settings → Clear pH Hide Login to set the default slug.

Emergency disable

If you lock yourself out:

  • SFTP/SSH: rename the plugin folder to disable it.
  • WP-CLI: wp option delete cph_hide_login_slug && wp cache flush
  • Database: DELETE FROM wp_options WHERE option_name = 'cph_hide_login_slug';

Changelog

1.0.1

  • Fix: honor reauth=1 on the login slug — stale/half-expired cookie states (logged_in cookie valid, auth cookie dead) used to bounce between the slug and wp-admin, ending in a 404/redirect loop. wp-login.php now clears the bad cookies and shows the form.
  • Fix: access logging actually defaults to ON. The settings screen showed logging enabled by default, but the recorder read the option with a default of off, so nothing was logged until the option was explicitly saved.

1.0.0

  • Initial release.