Hide WP Login SAML-Aware

A WordPress plugin that hides the default WordPress login page with a custom URL. Works perfectly with standard WordPress authentication, and also compatible with SAML authentication if you use it.

Description

Hide WP Login SAML-Aware is a security plugin that obscures your WordPress login page by replacing the default wp-login.php URL with a custom URL of your choice. This simple but effective technique prevents unwanted bots from finding your login page and attempting brute force attacks.

Works With or Without SAML

SAML is completely optional. This plugin works perfectly with standard WordPress authentication - you don't need any SAML setup to use it. The "SAML-Aware" name simply means that if you do use SAML authentication, this plugin won't break it (unlike other hide login plugins).

How It Works

1. Without SAML (Default): Users visit your custom login URL (e.g., https://yoursite.com/secure-login) and see the standard WordPress login form. This is perfect for most WordPress sites that just want to hide their login page from bots.

2. With SAML (Optional): If you have a SAML authentication plugin installed (like WP SAML Auth), this plugin preserves all SAML functionality. You can even enable the "Auto-Redirect to SAML" option to automatically send users to your SAML Single Sign-On page when they visit the login URL.

3. Clean Deactivation: If you deactivate the plugin, everything reverts to default WordPress behavior with no lasting impact on your site.

Why I Created This

I had an issue where popular hide login plugins conflicted with the WP SAML Auth plugin. So I wrote a hide login plugin that works differently - it properly detects and preserves SAML authentication URLs while still hiding the login page from unauthorized access. Whether you use SAML or not, this plugin keeps your login page secure and hidden from bots.

Key Features

• Custom Login URL: Replace the default WordPress login URL with your own custom slug
• SAML Compatibility: Automatically allows SAML authentication requests to pass through
• Auto-Redirect to SAML: Optional automatic redirection to SAML SSO when accessing the login page
• Security Enhancement: Blocks direct access to wp-login.php for non-SAML requests
• Debug Mode: Built-in debugging capabilities for troubleshooting
• Easy Configuration: Simple settings page in WordPress admin

How It Works

The plugin intercepts requests to the WordPress login page and:

1. For SAML Requests: Automatically detects and allows SAML authentication parameters (saml_acs, saml_sso, saml_sls, SAMLResponse, SAMLRequest) to access wp-login.php
2. For Custom Login Slug: Redirects users to your custom login URL for standard WordPress authentication
3. For Direct Access: Blocks unauthorized direct access to wp-login.php with a 404 error
4. For Auto-Redirect: Optionally redirects users from the custom login page directly to SAML SSO

Requirements

• WordPress 5.0 or higher
• PHP 7.4 or higher
• SAML authentication plugin is completely optional - the plugin works great with standard WordPress authentication alone

Installation

Method 1: WordPress Admin Panel (Recommended)

1. Download the latest release as a ZIP file
   1. https://github.com/m3puckett/wp-hidelogin-saml/releases/download/v2.1.4/wp-hidelogin-saml-2.1.4.zip
2. Log in to your WordPress admin panel
3. Navigate to Plugins > Add New
4. Click Upload Plugin at the top of the page
5. Click Choose File and select the downloaded ZIP file
6. Click Install Now
7. Once installed, click Activate Plugin

Method 2: Manual Installation via FTP

1. Download the latest release as a ZIP file
2. Extract the ZIP file on your computer
3. Upload the wp-hidelogin-saml folder to /wp-content/plugins/ directory via FTP
4. Log in to your WordPress admin panel
5. Navigate to Plugins > Installed Plugins
6. Find "Hide WP Login SAML-Aware" and click Activate

Method 3: Manual Installation via SSH

cd /path/to/wordpress/wp-content/plugins/
wget https://github.com/m3puckett/wp-hidelogin-saml/archive/refs/heads/main.zip
unzip main.zip
mv wp-saml-hidelogin-fix-main wp-hidelogin-saml

Then activate the plugin from the WordPress admin panel.

Configuration

Basic Setup

1. After activation, go to Settings > SAML Hide Login in your WordPress admin panel
2. In the Custom Login Slug field, enter your desired login URL slug (e.g., mylogin, secure-access, etc.)
3. Click Save Settings

Your new login URL will be: https://yoursite.com/your-custom-slug

Reserved Slugs

The following slugs cannot be used as they are reserved by WordPress:

• wp-admin
• wp-includes
• wp-content
• admin
• login
• wp-login
• dashboard

Auto-Redirect to SAML (Optional)

If you want users to automatically be redirected to SAML SSO when they visit the login page:

1. Go to Settings > SAML Hide Login
2. Check the Enable automatic redirect to SAML authentication option
3. Click Save Settings

When enabled, visitors accessing the custom login page will be automatically redirected to wp-login.php?saml_sso

Debug Mode

The plugin includes debug logging that can be enabled by editing hidelogin.php:

define('SHL_DEBUG', true); // Set to false in production

When enabled, debug messages will be written to your PHP error log (requires WP_DEBUG_LOG to be enabled in wp-config.php).

SAML URLs

The following SAML authentication URLs will always work, regardless of your custom login slug:

• SAML ACS (Assertion Consumer Service): https://yoursite.com/wp-login.php?saml_acs
• SAML SSO (Single Sign-On): https://yoursite.com/wp-login.php?saml_sso
• SAML SLS (Single Logout Service): https://yoursite.com/wp-login.php?saml_sls

Configure these URLs in your SAML Identity Provider settings.

Automatic Updates

This plugin supports automatic updates from GitHub! Once installed, WordPress will automatically check for new versions and notify you when updates are available.

Usage Examples

Example 1: Basic Custom Login

1. Set custom login slug to: secure-login
2. Your new login URL: https://yoursite.com/secure-login
3. SAML URLs remain: https://yoursite.com/wp-login.php?saml_acs (and other SAML endpoints)

Example 2: Auto-Redirect to SAML

1. Set custom login slug to: staff-login
2. Enable auto-redirect to SAML
3. Users visit: https://yoursite.com/staff-login
4. Plugin automatically redirects to: https://yoursite.com/wp-login.php?saml_sso
5. Users authenticate via SAML SSO

Frequently Asked Questions

Will this break my SAML authentication?

No. The plugin is specifically designed to preserve SAML functionality. All SAML-related requests are automatically detected and allowed to access wp-login.php.

What happens to my existing login URL?

Direct access to wp-login.php (without SAML parameters) will be blocked and return a 404 error. Only your custom login slug and SAML authentication URLs will work.

Can I still use WordPress authentication?

Yes. Access your custom login slug (e.g., https://yoursite.com/your-custom-slug) to use standard WordPress authentication, unless you've enabled auto-redirect to SAML.

What if I forget my custom login slug?

You can disable the plugin via FTP by renaming the plugin folder in /wp-content/plugins/, or you can check your database in the wp_options table for the shl_login_slug option.

Does this plugin work with other security plugins?

Yes, it should be compatible with most WordPress security plugins. However, test compatibility in a staging environment first.

Troubleshooting

I can't access my login page

1. Check that you're using the correct custom login slug
2. Verify the slug in Settings > SAML Hide Login
3. If locked out, disable the plugin via FTP by renaming the plugin folder

SAML authentication isn't working

1. Verify your SAML plugin is active
2. Check that you're using the correct SAML URLs in your IdP configuration
3. Enable debug mode and check error logs
4. Verify wp-login.php?saml_acs (and other SAML endpoints) are accessible

How do I enable debug logging?

1. Edit hidelogin.php and set define('SHL_DEBUG', true);
2. In wp-config.php, ensure these are set:

   define('WP_DEBUG', true);
   define('WP_DEBUG_LOG', true);

3. Check /wp-content/debug.log for log entries

Packaging for Distribution

To create a distributable ZIP file:

# From the plugin directory
cd /path/to/wp-saml-hidelogin-fix

# Create a clean directory with the correct plugin name
mkdir -p ../wp-hidelogin-saml
cp hidelogin.php ../wp-hidelogin-saml/
cp LICENSE ../wp-hidelogin-saml/
cp README.md ../wp-hidelogin-saml/
cp readme.txt ../wp-hidelogin-saml/

# Create the ZIP file
cd ..
zip -r wp-hidelogin-saml.zip wp-hidelogin-saml/

# Clean up
rm -rf wp-hidelogin-saml/

The resulting wp-hidelogin-saml.zip file can be uploaded via the WordPress admin panel.

Changelog

Version 2.1.0

• Fixed SAML authentication compatibility
• Added auto-redirect to SAML option
• Improved debug logging
• Enhanced security for login page hiding
• Updated to GPL v3 license

Version 2.0.0

• Complete rewrite for better SAML compatibility
• Added settings page
• Improved request detection

Version 1.0.0

• Initial release

Security Considerations

• This plugin enhances security through obscurity by hiding the default login URL
• Always use strong passwords and two-factor authentication
• Regularly update WordPress core, themes, and plugins
• Monitor access logs for suspicious activity
• Use HTTPS for all login pages

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Development

1. Fork the repository
2. Create a feature branch: git checkout -b feature/my-new-feature
3. Commit your changes: git commit -am 'Add some feature'
4. Push to the branch: git push origin feature/my-new-feature
5. Submit a pull request

Support

For bugs, feature requests, or questions:

• GitHub Issues: https://github.com/m3puckett/wp-hidelogin-saml/issues
• GitHub Repository: https://github.com/m3puckett/wp-hidelogin-saml

License

This plugin is licensed under the GNU General Public License v3.0 or later.

Copyright (C) 2025 Mark Puckett

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.

Credits

Developed by Mark Puckett (https://github.com/m3puckett)