Moo Digital WordPress Redirect Plugin

A simple yet powerful WordPress plugin that redirects non-logged-in users to a specific page and provides the option to use a custom login URL for enhanced security.

Features

• User Redirect Control: Automatically redirect non-logged-in users to any URL (internal or external)
• Custom Login URL: Hide your WordPress login page by using a custom URL slug
• Security Through Obscurity: When custom login is enabled, /wp-login.php shows a 404 error to unauthorised visitors
• Smart Exceptions: Automatically allows access to login pages, AJAX requests, REST API, and admin areas
• Password Reset Protection: Password reset functionality continues to work even with custom login URL enabled
• Simple UI: Clean, user-friendly settings page under Settings > Moo Digital Redirect
• Optional Features: Both redirect and custom login features can be disabled independently

Use Cases

• Private membership sites that require login for all content
• Coming soon pages during development
• Maintenance mode with redirect to external status page
• Enhanced security by hiding default WordPress login URL
• Beta sites requiring authentication before access

Installation

1. Download the plugin file
2. Upload moo-digital-redirect-login.php to /wp-content/plugins/
3. Activate the plugin through the 'Plugins' menu in WordPress
4. Configure settings via Settings > Moo Digital Redirect

Configuration

Redirect URL

Navigate to Settings > Moo Digital Redirect and configure:

1. Redirect URL: Enter the URL where non-logged-in users should be sent

   • Can be internal (e.g., https://yoursite.com/coming-soon/)
   • Can be external (e.g., https://status.yourcompany.com)
   • Leave blank to disable redirects (WordPress works normally)

2. Custom Login URL: Enter a custom slug for your login page

   • Example: my-secure-login becomes https://yoursite.com/my-secure-login/
   • Leave blank to use default /wp-login.php
   • When enabled, direct access to /wp-login.php shows a 404 error

Example Configurations

Private Membership Site

Redirect URL: https://yoursite.com/membership-info/
Custom Login URL: members-login

Result: Non-members see the info page, members login at /members-login/

Coming Soon Page

Redirect URL: https://yoursite.com/coming-soon/
Custom Login URL: (leave blank)

Result: Public sees coming soon page, admins can login normally

External Redirect

Redirect URL: https://status.company.com
Custom Login URL: secure-access

Result: Visitors redirected to external site, team accesses via custom URL

Disable All Features

Redirect URL: (leave blank)
Custom Login URL: (leave blank)

Result: WordPress works completely normally

How It Works

Redirect Logic

When a non-logged-in user visits your site:

1. Allowed Pages (no redirect):

   • Login page (/wp-login.php or custom URL)
   • The configured redirect URL itself
   • Admin area (for edge cases)
   • AJAX requests
   • REST API requests

2. Redirected Pages:

   • Everything else redirects to your configured URL

3. Logged-in Users:

   • Can access everything normally

Custom Login URL

When enabled:

• Your custom URL (e.g., /my-login/) redirects to the actual WordPress login
• Direct access to /wp-login.php shows a 404 error (unless coming from your custom URL)
• Password reset links still work (uses special action parameters)
• Logout functionality continues to work
• Reserved slugs are blocked (e.g., wp-admin, admin, login)

Security Features

• Input Sanitisation: All URLs are sanitised and validated
• Reserved Slug Protection: Prevents use of WordPress core slugs
• URL Validation: Ensures redirect URLs are properly formatted
• Trailing Slash Consistency: Prevents redirect loops
• Safe Internal Redirects: Uses wp_safe_redirect() for internal URLs
• 404 Protection: Direct login access blocked when custom URL is set

Smart Exceptions

The plugin intelligently skips redirects for:

• AJAX requests (DOING_AJAX constant)
• REST API requests (REST_REQUEST constant)
• WordPress admin area (is_admin())
• Login page and password reset actions
• The redirect destination itself (prevents loops)

Troubleshooting

I'm locked out!

If you've set a custom login URL and forgotten it:

1. Access your site via FTP or hosting control panel
2. Navigate to /wp-content/plugins/
3. Rename the plugin folder temporarily (e.g., to moo-digital-redirect-login-disabled)
4. You can now access /wp-login.php normally
5. Rename the folder back after logging in

Redirect loop detected

This shouldn't happen due to built-in protection, but if it does:

1. Check that your redirect URL is not redirecting to itself
2. Ensure trailing slashes are consistent
3. Try clearing browser cache and cookies
4. Disable the plugin temporarily to regain access

Password reset isn't working

Password resets should work automatically. If they don't:

1. Check that you're using the link from the email exactly as provided
2. Ensure you haven't created a page with the same slug as your custom login URL
3. Try disabling the custom login URL temporarily

Custom login URL shows 404

If your custom URL shows a 404:

1. Visit Settings > Permalinks and click "Save Changes" (flush rewrite rules)
2. Ensure you don't have a page/post with the same slug
3. Check that the slug doesn't conflict with existing WordPress URLs

Requirements

• WordPress 5.0 or higher
• PHP 7.0 or higher

Plugin Structure

moo-digital-redirect-login.php (single file plugin)

This plugin follows the K.I.S.S. principle - everything is contained in a single file for simplicity.

Admin Interface

Settings are located at Settings > Moo Digital Redirect with:

• Clear explanations of how the plugin works
• Visual feedback for configuration
• Helpful placeholder text
• Example URLs for guidance

Important Notes

Security Considerations

• Custom login URLs provide security through obscurity, not true security
• Always use strong passwords and keep WordPress updated
• The custom URL can still be discovered through various means
• This is a deterrent to automated attacks, not a complete security solution

Performance

• Minimal performance impact (runs only on frontend page load)
• No database queries on logged-in user requests
• Efficient checks prevent unnecessary processing

Multisite Compatibility

This plugin is designed for single-site WordPress installations. Multisite compatibility has not been tested.

Changelog

2.0

• Added custom login URL feature
• Improved security with 404 on direct /wp-login.php access
• Password reset protection
• Reserved slug validation
• Better URL sanitisation
• Default settings now disable features (empty values)

1.0

• Initial release
• Basic redirect functionality for non-logged-in users

License

GPL v2 or later

Credits

Created by Moo Digital

Support

For support or feature requests, please contact Moo Digital or submit an issue on the GitHub repository.