SunriseCreative

Brilliant, thanks very much for the update 😉

I have not had any further issues since disabling XML-RPC. Thanks for your help.

With login.php renamed and XML-RPC disabled I am still getting a few emails from Wordfence telling me someone has been locked out for using an invalid username. Nobody apart from me knows the login URL.

Any thoughts?

It depends on which theme you are using but if you have made the Meta widget inactive and the log in link is still visible then it might be because you have no active widgets at all. In some of the default themes the Meta widget will show up by default if you don’t have any active widgets.

The log in link goes where it should do. At the bottom of the log in page there should be a link to the register page as well.

If you need any more help please post a link to your website, let us know which theme you are using and which widgets you have made active.

I found someone to help me with this (thanks Adam) – I am posting the solution here in case anyone else is looking to do the same thing.

In your child theme create a functions.php file and add the following code to it:

<?php
function remove_meta_widget() {
    unregister_widget('WP_Widget_Meta');
    register_widget('WP_Widget_Meta_Mod');
}

add_action( 'widgets_init', 'remove_meta_widget' );

/**
 * Meta widget class
 *
 * Displays log in/out, RSS feed links, etc.
 *
 * @since 2.8.0
 */
class WP_Widget_Meta_Mod extends WP_Widget {

function __construct() {
$widget_ops = array('classname' => 'widget_meta', 'description' => __( "Log in/out, admin, feed and WordPress links") );
parent::__construct('meta', __('Meta'), $widget_ops);
}

function widget( $args, $instance ) {
extract($args);
$title = apply_filters('widget_title', empty($instance['title']) ? __('Meta') : $instance['title'], $instance, $this->id_base);

echo $before_widget;
if ( $title )
echo $before_title . $title . $after_title;
?>
<ul>
<?php wp_register(); ?>
<li><?php wp_loginout(); ?></li>
<li><a href="<?php bloginfo('rss2_url'); ?>" title="<?php echo esc_attr(__('Syndicate this site using RSS 2.0')); ?>"><?php _e('Entries <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
<li><a href="<?php bloginfo('comments_rss2_url'); ?>" title="<?php echo esc_attr(__('The latest comments to all posts in RSS')); ?>"><?php _e('Comments <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
<li><a href="<?php esc_attr_e( 'http://ww.wp.xz.cn/' ); ?>" title="<?php echo esc_attr(__('Powered by WordPress, state-of-the-art semantic personal publishing platform.')); ?>"><?php
/* translators: meta widget link text */
_e( 'ww.wp.xz.cn' );
?></a></li>
<?php wp_meta(); ?>
</ul>
<?php
echo $after_widget;
}

function update( $new_instance, $old_instance ) {
$instance = $old_instance;
$instance['title'] = strip_tags($new_instance['title']);

return $instance;
}

function form( $instance ) {
$instance = wp_parse_args( (array) $instance, array( 'title' => '' ) );
$title = strip_tags($instance['title']);
?>
<p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
<?php
}
}

?>

This bit:

function remove_meta_widget() {
	unregister_widget('WP_Widget_Meta');

unregisters the existing meta widget and this bit:

register_widget('WP_Widget_Meta_Mod');

registers a modified version of it. The contents of the new version are the rest of the code above. So to remove the link to the WordPress site for example you would simply remove this bit of code from your functions.php file:

<li><a href="<?php esc_attr_e( 'http://ww.wp.xz.cn/' ); ?>" title="<?php echo esc_attr(__('Powered by WordPress, state-of-the-art semantic personal publishing platform.')); ?>"><?php
/* translators: meta widget link text */
_e( 'ww.wp.xz.cn' );
?></a></li>