[{"data":1,"prerenderedAt":96},["ShallowReactive",2],{"\u002F2024-02-29-a-simple-way-to-hide-wordpress-login-url":3},{"id":4,"title":5,"body":6,"date":81,"description":12,"extension":82,"meta":83,"navigation":89,"path":90,"seo":91,"stem":92,"tags":93,"__hash__":95},"blogs\u002F_legacy\u002F2024\u002F2024-02-29-a-simple-way-to-hide-wordpress-login-url.md","一个简单的隐藏Wordpress登录地址的方式",{"type":7,"value":8,"toc":73},"minimark",[9,13,17,20,23,31,34,44,47,53,56,59,62],[10,11,12],"p",{},"Wordpress的登陆地址总是会遇到很多自动化扫描，虽然加个Recaptcha或者2FA就能解决，但是总是会想要阻挡下，说不定什么时候哪里就爆出漏洞导致自动登陆了。",[14,15,16],"h2",{"id":16},"访问过滤",[10,18,19],{},"看了下Wordpress的官方文档，以及稍微做了下搜索。",[10,21,22],{},"发现要通过插件来阻止登陆其实还是挺简单的。",[10,24,25,26,30],{},"只要hook到",[27,28,29],"code",{},"init","上，就可以对所有的访问进行一次过滤了。",[10,32,33],{},"由于不想搞得太复杂，最后决定采用Session来存储用户的访问信息。",[10,35,36,37,40,41,43],{},"当用户访问",[27,38,39],{},"wp-login.php","时，如果携带了符合要求的参数对，就会给用户加一个许可的Session。如果用户在访问",[27,42,39],{},"的时候没有提供正确的参数对，就会被自动重定向到主页。",[14,45,46],{"id":46},"登陆控制",[10,48,49,50,52],{},"由于不是很清楚Wordpress的流程，无法确定",[27,51,29],{},"的action是否能够阻止直接post登陆的情况。",[10,54,55],{},"因此额外的hook了登陆流程。只有在用户具有正确的Session的情况下，才能完成登陆的校验流程。",[10,57,58],{},"这样就可以防止某些可能存在的未知登陆的情况了。",[14,60,61],{"id":61},"插件代码",[10,63,64,65,72],{},"直接放到了",[66,67,71],"a",{"href":68,"rel":69},"https:\u002F\u002Fgithub.com\u002FArisego\u002FWpLockLogin",[70],"nofollow","GitHub","上，不过如果要用的话需要注意风险。必须保证能在不用重新登陆的情况下删除这个插件，不然万一出问题可能就一直登不进去了。",{"title":74,"searchDepth":75,"depth":76,"links":77},"",2,3,[78,79,80],{"id":16,"depth":75,"text":16},{"id":46,"depth":75,"text":46},{"id":61,"depth":75,"text":61},"2024-02-29","md",{"layout":84,"excerpt":85},"post",{"type":7,"value":86},[87],[10,88,12],{},true,"\u002F2024-02-29-a-simple-way-to-hide-wordpress-login-url",{"title":5,"description":12},"_legacy\u002F2024\u002F2024-02-29-a-simple-way-to-hide-wordpress-login-url",[94],"Wordpress","qox_b8OKgNhvBDsetI8Ne-zAzIGWT2l9L1-7ZnwOkYc",1788763176490]