The wp-login is hide from bad guys but not from people in white list. Your IP adresse is probably in white list so WP Cerber let you see this page…
Read this for more info : https://ww.wp.xz.cn/support/topic/disable-wp-loginphp-does-not-working/#post-7307480
Thread Starter
MyCoach
(@bernard77176)
Several years I use the Plugin and I think there is a problem.
I have only one IP address in a whitelist.
I did the test with another IP address and the problem is still there !!!!.
It logs a connection attempt with a block, but the blocking on the wp-login page does not work and if we just type an identifier ex: ‘toto’ and input, it redirects to “wp-login” with l Hidden address.
thank you
Are the two websites on the same server ? Multisite install ?
Thread Starter
MyCoach
(@bernard77176)
Non Vincent, plusieurs installations sur un serveur, j’ai essayé et problèmes divers.
Donc !
Plugin Author
gioni
(@gioni)
@bernard77176 Could you please use normal words? At least use the same words and phrases as they are used for the settings in the admin interface of the plugin and features you are trying to test out.
Thread Starter
MyCoach
(@bernard77176)
Sorry, for my bad english,
This is an automatic translation !!!
Since the update, the plugin no longer plays its protection role on the WP-LOGIN page.
It was by chance that I discovered the problem by trying to connect outside my home.
The IP address of this PC is not in a whitelist.
I have only one address in a whitelist.
I did the test by deleting the history and all the parameters of the browser, it is the same!
The protection of wp-login: custom login URL no longer does its job.
If I log on to wp-login the login form appears while I checked the box: Disable wp-login.php.
If I put an incorrect ID and validate it, it returns me to the page with the custom connection.
However, in the dashboard, it saves and blocks the IP.
I hope i was clear.
I can give you my web address by private message
Thanks again and sorry for my bad English
Bernard
Plugin Author
gioni
(@gioni)
You have to use an IP that is not in the White List AND turn on the incognito mode in your browser – for instance use menu “New incognito window” in Chrome.
Thread Starter
MyCoach
(@bernard77176)
I did as you said in incognito mode with ip adress no in white list, it’s the same.
The wp-login page is not redirecting to 404, the login form is there.
If I make a false connection attempt, it redirects me to the custom login address .
But he registers the fraudulent connection attempt by marking 2 lines on the dashboard:
Blocked network
Attempt to connect with a non-existent identifier.
But it does not mark the attempt to access a forbidden url, whereas this IP address had access to this url.
Plugin Author
gioni
(@gioni)
Did you check “Block direct access to wp-login.php and return HTTP 404 Not Found Error”?
Comme il te demande est ce que tu as coché :
Requête sur wp-login.php – Bloquer immédiatement l’IP si elle tente d’accéder au à wp-login.php
et
Désactiver wp-login.php – Bloquer l’accès direct à wp-login.php et retourner une erreur HTTP 404 Not Found
Les deux options sont dans cet ordre dans les réglages généraux à quelques lignes d’intervalle.
Thread Starter
MyCoach
(@bernard77176)
Yes, here is my Cerber configuration
Block subnets: checked
Non-existent users: checked
Redirect dashboard queries: checked
Query on wp-login.php: checked
Display 404 page: Use 404 template from active theme
Custom connection URL: custom url without conflict
Disable wp-login.php: checked
!!!
Thread Starter
MyCoach
(@bernard77176)
Merci Vincent, j’avais compris!
Thread Starter
MyCoach
(@bernard77176)
Just an idea, is that it would not be related to API Rest
This seems similar to the following Topic:
Cela signifie que si quelqu’un définit leur page de connexion sur un modèle qui correspond à un point final REST, il brise la requête REST à la place de l’appel à example.com/wp-json/login en faisant / renvoyant ce qu’il devrait, le plugin interceptera le Demandez et renvoyez la page de connexion.
custom-login-url-bug
Plugin Author
gioni
(@gioni)
The topic you have mentioned is not the case and not applicable since v 5.0.
