Support Forum

Moving Simple:Press login to prevent brute force WP attacks

PS Paul Smith
Paul Smith
Member

My web host, Liquidweb, keeps putting a rule in place which only allows authorised IP addresses. With over 7,000 registered site users this security measure obviously isn’t practical for me. My forum users are being locked out of the forum.

I have been told that I need to install a plugin to change the address of WP login to deter the brute force attacks. Can you suggest a suitable plugin to use and tell me how to change the inline forum login so that it points at the new address?

Thanks,

Paul

 

25 Answers

New Answer

MP Mr Papa
Mr Papa
Member

I would recommend Theme My Login plugin for WP.. it allows you to disable wp-login.php and use alternate…

as to simple press, you would then need to disable our inline login form and instead send the login button to your custom login page…

PS Paul Smith
Paul Smith
Member

Can you point me in the right direction for disabling the inline form and sending the login button to a different address?

MP Mr Papa
Mr Papa
Member

http://codex.simple-press.com/codex/api/template-functions-and-the-api/display-template-functions/common-view/sp_loginoutbutton/

if you set the logInLink argument to a url, it will redirect there instead of opening an inline form…  if you do that, you may also want to remove the inlne form itself by removing the spLoginForum template function call (http://codex.simple-press.com/codex/api/template-functions-and-the-api/display-template-functions/common-view/sp_loginform/)

PS Paul Smith
Paul Smith
Member

I want to resurrect this old thread because I’m having the same problem again as I did a year ago when I first brought up the subject. Your solution to the problem is clear and, I’m sure to you, straight forward. Unfortunately it is beyond me. Do you know who I could pay to make the changes for me and what the cost would be?

Paul

MP Mr Papa
Mr Papa
Member

I am unsure exactly what you want to do based on the discussion…

If you want to:

a)  change the login url of wp from http://yoursite.com/wp-login.php to something else, ie http://yoursite.com/mylogin

and

b) then have simple press login button redirect to that login page

that is pretty simple and straight forward…

1)  install the theme my login plugin (https://wordpress.org/plugins/theme-my-login/) which allows you to set up your login page as you want…

2) update the sp_LogInOutButton template tag (see https://simple-press.com/documentation/codex/api/template-functions-and-the-api/display-template-functions/common-view/sp_loginoutbutton/) in your sp theme, from (based on default theme):

            sp_LogInOutButton('tagClass=spButton spRight', __sp('Log In'), __sp('Log Out'), __sp('Log in and log out'));

to

            sp_LogInOutButton('tagClass=spButton spRight&logInLink=http://yoursite.com/mylogin', __sp('Log In'), __sp('Log Out'), __sp('Log in and log out'));

the change being adding:

&logInLink=http://yoursite.com/mylogin

so give it a shot… If you still would like us to do it, we could do the work for $25…

PS Paul Smith
Paul Smith
Member

Thank you for your very comprehensive DIY reply but I would rather remove the weakest link from the chain (me) and ask you to do it for me. How do I pay you and how quickly can you do the work?

PS Paul Smith
Paul Smith
Member

Is Mr Papa about today? He has done some work on my site to resolve the above issue but something was lost in translation. I sent him a PM this morning but I haven’t had a reply yet.

YS Yellow Swordfish
Yellow Swordfish
Member

Steve is in Los Angeles. So it is mid-morning there at the moment and he will, no doubt, be at work. He will be around later on I am sure.
Can you tell me the issue?

PS Paul Smith
Paul Smith
Member

Here is the message I sent him after he made the changes…

“It’s not quite right I’m afraid.

DAP is used to protect paid for content on the site and not for logging in WP users to the forum. I think DAP is supposed to sync with WP but I’ve had problems with that in the past.The reason I didn’t give you an email address and password instead of a user name and password is that currently forum users need to log in to WP (user name and password) to use the forum and log in to DAP (email address and password) for the protected content. Of course in an ideal world there would just bee one login for both but I haven’t been able to resolve the issues with DAP syncing with WP.

The changes you have made now mean that forum users are being redirected to the DAP login form so won’t be able to log in to the forum and new registrants are being directed to a redundant page.

I thought I asked, and maybe I didn’t make myself clear, for the WP login and registration forms to be moved to courtesy of the plugin you mentioned in order to deter brute force logins and the forum login and registration links to reflect the changes. Are you able to do this?

I hope I haven’t confused the issue any more!”

MP Mr Papa
Mr Papa
Member

DAP was never mentioned, but really doesnt matter…

but I think there is a misunderstanding…  there are NO SP users…  we dont have users… we use the WP users…  also, you do not log into simple press (ie the forum)…  you log into WP… 

so just to be clear, they must be WP users (sp does not create any) and they must log into wp…

I have set up several sites with WP and DAP and the syncing has always worked fine…  in fact, if your users are logging in to WP via the WP login form on the forum page (again, its a wp login form) or wp-login.php, then you do have DAP syncing them to WP for you…

So I can still make a few adjustments for you, just need a better definition of what you want to do…

so you want yet another page that logins to wp?  I can provide that with the theme my login plugin (it looks like you tried that previously)…  but what do you want the url of the page to be since the http://yoursite.com/login is being used for something else??? and its the standard page for theme my login too…

and what do you want the register link on the forum page to redirect to??  you already have /register and /register-2

PS Paul Smith
Paul Smith
Member

The problem that I have is that DAP and WP users don’t seem to by in sync on my site. I know they are supposed to, but they aren’t. Just to make sure, I’ve just logged in to DAP via the log in button which you have edited on the forum. I was logged successfully in to DAP but when I switched back to the forum, I wasn’t logged in to the forum. I had to log in to WP separately before I was logged in to the forum.

It’s a situation which has driven both me and many of my users mad over the last couple of years. There’s constantly confusion which login form to use for which part of the site but I haven’t had a clue how to resolve the issue so it has remained a problem.

Are you interested in giving me a price for sorting the problem out so that both DAP and WP are in sync?

If not, then here’s what I need.

  • The WP login and register URLs need to be moved to thwart brute force log ins
  • The forum log in button needs to reflect the changed URL
  • The forum register button needs to reflect the changed URL

Let me know if you need more information.

Thanks,

Paul