Hide My WP: Add-on-Sicherheits-Plugin für WordPress | wp-admin & Login-URL verbergen und über 40 Funktionen
Hide My WP (Hide My WordPress) ändert oder verbirgt die Login-URL von WordPress, wp-admin sowie die Pfade von Themes und Plugins und lässt sich mit diesen Haupt- und Zusatzfunktionen zu den WordPress-Sicherheits-Plugins zählen. Da WordPress seine Login-Adresse wp-admin offen zeigt, kannst du sie mit einem Sicherheits-Plugin verbergen, das den Schutz verstärkt.
Darunter ist Hide My WP ein kostenpflichtiges Plugin, das neben dem Verbergen von Login-URL und wp-admin rund 40 Funktionen bietet, etwa geänderte Theme- und Plugin-Pfade, Einbruchserkennung und IP-Sperren sowie das Ausschalten von XML-RPC.
1️⃣ Einstellungsseite von Hide My WP
Die Seite [Settings] des Plugins Hide My WP ist in sechs Tabs unterteilt: Start, Hiding, Permalinks, Protection, Cleanup und Replace. Login-URL und Verbergen findest du in den Tabs [Hiding] und [Permalinks], XML-RPC im Tab [Cleanup].
Einstellungssimulator für Hide My WP
Mit [See More] gelangst du zur Liste dieser Einträge.
In jeder Zeile kannst du [Exclude], [Ban IP], [Delete] und [Filter] anklicken.
Mit [Whitelist this IP], [Delete] und [Filter by Source] änderst du die Liste.
[Feedback] führt zur externen Roadmap-Adresse des Herstellers, die [Page not found] anzeigt.
[Manual Configuration] öffnet in einem neuen Tab die Regeln, die du von Hand in die .htaccess einträgst.
Alle Felder lassen sich ändern; ändere die vier gelben Felder und klicke auf [Save Settings], dann ändert sich unten die Ansicht für abgemeldete Besucher.
Adminbereich — Hide My WP › Settings
Item permanently deleted.%s items permanently deleted.Item added to the exceptions list.%s items added to the exceptions list.IP added to the block list.%s IPs added to the block list.IP added to the whitelist.%s IPs added to the whitelist.All logs have been deleted!Search results for “%s”1 item%s itemsPrevious settings have been restored!
Dashboard
Your website may be visible to hackers and detectors. Click on "Show Fixes" to fix 1 issues we have detected.
- Your full hide is disable, Wapplyzer will detect you are using WordPress.
12
Blocked Attack Chart
IDS Attack Blocked
| Name | Value | Impact / Total | IP | Date |
|---|---|---|---|---|
get-file | ../../../../etc/passwd | 25 / 50 | 198.51.100.44 | Oct 13 2026 |
request-file | ../../../../etc/passwd | 25 / 50 | 198.51.100.44 | Oct 13 2026 |
get-id | 1' UNION SELECT user_login,user_pass FROM wp_users-- | 34 / 68 | 198.51.100.9 | Oct 13 2026 |
request-id | 1' UNION SELECT user_login,user_pass FROM wp_users-- | 34 / 68 | 198.51.100.9 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.140 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.140 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.77 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.77 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.25 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.25 | Oct 13 2026 |
5
IP Blocked Attack Chart
IP Attack Blocked
| IP | Date |
|---|---|
203.0.113.10 | Oct 09 2026 |
198.51.100.44 | Oct 10 2026 |
203.0.113.140 | Oct 11 2026 |
198.51.100.9 | Oct 12 2026 |
203.0.113.25 | Oct 13 2026 |
HMWP IDS Log
| Name | Value | Page | Impact / Total | IP / User | Date | |
|---|---|---|---|---|---|---|
| GET.file | | | ../../../../etc/passwd | /?file=../../../../etc/passwd | 25 / 50 | 198.51.100.44 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.file | | | ../../../../etc/passwd | /?file=../../../../etc/passwd | 25 / 50 | 198.51.100.44 Guest KR | October 13, 2026 2:16 pm | |
| GET.id | | | 1' UNION SELECT user_logi... 1' UNION SELECT user_login,user_pass FROM wp_users-- | /?id=1%27%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users-- | 34 / 68 | 198.51.100.9 Guest | October 13, 2026 2:16 pm | |
| REQUEST.id | | | 1' UNION SELECT user_logi... 1' UNION SELECT user_login,user_pass FROM wp_users-- | /?id=1%27%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users-- | 34 / 68 | 198.51.100.9 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.140 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.140 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.77 Guest | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.77 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest | October 13, 2026 2:16 pm | |
| Name | Value | Page | Impact / Total | IP / User | Date |
* Value is sanitized for your safety
How good is that, no intrusions.
No intrusions found.
HMWP Blocked IP Addresses
(5) | (4) | (1)
5 items
| 203.0.113.10 | | October 9, 2026 6:30 pm | ||
| 198.51.100.44 | | Outside Allowed Countries | October 10, 2026 3:17 am | |
| 203.0.113.140 | | Blocked Countries | October 11, 2026 10:05 pm | |
| 198.51.100.9 | | Trust Network | October 12, 2026 9:41 am | |
| 203.0.113.25 | | Manual Blocking | October 13, 2026 2:20 pm | |
| No items found. | |||
Manual Configuration
In rare cases you need to configure it manually.
- If you use BulletProof Security plugin, first secure the htaccess file using it and then add the following lines to your htaccess file using FTP.
- You may need to reconfigure the server whenever you change settings or activate a new theme or plugin.
- Add these lines right before: RewriteCond %{REQUEST_FILENAME} !-f. Next, you may want to change htaccess permission to read-only (e.g., 666)
Nothing to add for current settings!
Hide My WP
Settings was updated successfully!
Start
Purchase Code
Enter your Purchase Code to make sure everything work as expected. Get it.
Import Options
Paste your settings code below or choose a pre-made settings scheme.
Export Options
Copy your export code and save it somewhere for later use.
Copy your export code and save it somewhere for later use.
{"li":"","import_options":"","export_options":"","debug_report":"","help":"","undo":"","uninstall_hmwp_data":"","hide_wp_login":"","login_query":"hide_my_wp","admin_key":"1234","hide_wp_admin":"","spy_notifier":"","antispam":"","full_hide":"","hide_online_detectors":"","hide_other_wp_files":"","disable_directory_listing":"","disable_canonical_redirect":"","hide_admin_bar":"on","separator":"","custom_404":"0","custom_404_page":"","trusted_user_roles":"","replace_mode":"quick","customized_htaccess":"","cdn_path":"","email_from_name":"","email_from_address":"","avoid_direct_access":"","direct_access_except":"index.php, wp-comments-post.php, wp-includes/js/tinymce/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin/upgrade.php","exclude_theme_access":"","exclude_plugins_access":"","new_theme_path":"","new_style_name":"","style_expiry_days":"","auto_config_plugins":"","new_include_path":"","new_plugin_path":"","rename_plugins":"","new_upload_path":"","replace_comments_post":"","replace_admin_ajax":"","new_content_path":"","separator2":"","new_login_path":"","new_admin_path":"","separator3":"","api_disable":"0","api_base":"","api_query":"rest_route","author_enable":"1","author_base":"/author","author_query":"author","author_without_base":"","feed_enable":"1","feed_base":"/feed","feed_query":"feed","post_enable":"1","post_base":"/%postname%/","post_query":"p","page_enable":"1","page_base":"/","page_query":"page_id","paginate_enable":"1","paginate_base":"/page","paginate_query":"paged","category_enable":"1","category_base":"","category_query":"cat","tag_enable":"1","tag_base":"","tag_query":"tag","search_enable":"1","search_base":"/search","search_query":"s","nice_search_redirect":"","disable_archive":"","disable_other_wp":"","remove_html_comments":"","minify_new_style":"","replace_javascript_path":"1","remove_feed_meta":"on","remove_other_meta":"on","remove_default_description":"on","remove_ver_scripts":"","remove_body_class":"","remove_menu_class":"","clean_post_class":"","clean_new_style":"","replace_in_ajax":"","replace_wpnonce":"","disable_xml_rpc":"","internal_css":"","internal_js":"","enable_ids":"on","ids_mode":"0","ids_email":"admin@example.com","ids_level":"0","ids_admin_include":"","ids_cookie":"","logger_link":"","log_ids_min":"5","block_ids_min":"30","email_ids_min":"30","exception_fields":"REQUEST.comment[new_line]POST.comment[new_line]REQUEST.permalink_structure[new_line]POST.permalink_structure[new_line]REQUEST.selection[new_line]POST.selection[new_line]REQUEST.content[new_line]POST.content[new_line]REQUEST.__utmz[new_line]COOKIE.__utmz[new_line]REQUEST.s_pers[new_line]COOKIE.s_pers[new_line]REQUEST.user_pass[new_line]POST.user_pass[new_line]REQUEST.pass1[new_line]POST.pass1[new_line]REQUEST.pass2[new_line]POST.pass2[new_line]REQUEST.password[new_line]POST.password[new_line]POST.hide_my_wp.%[new_line]REQUEST.hide_my_wp.%[new_line]POST.%import%[new_line]REQUEST.%import%[new_line]REQUEST.newcontent[new_line]POST.newcontent[new_line]REQUEST.remember_%","ids_html_fields":"","separator4":"","avoid_wp_admin_access":"","allowed_ips_wp_admin_access":"203.0.113.10","trust_network":"on","help_trust_network":"","enable_smwp_server":"","blocked_ips":"","blocked_ip_message":"You are blocked. Please contact site administrator if you think there is a problem. ","blocked_countries":"","allowed_countries":"","replace1":"","replace2":"","new_intrusions_count":"0"}Debug Report
Provide above report to support team to get better and faster service.
===========================================================
WP Settings
===========================================================
WordPress version: WP 7.1.3
Home URL: https://example.com
Site URL: https://example.com
Is SSL: true
Is RTL: false
Permalink: /%postname%/
============================================================
Server Environment
============================================================
PHP Version: 8.3
Server Software: Apache
WP Max Upload Size: 2 GB
Server upload_max_filesize: 2048M
Server post_max_size: 2048M
WP Memory Limit: 40M
WP Debug Mode: false
CURL: true
fsockopen: true
============================================================
Active plugins
============================================================
Hide My WP 6.2.12 [http://hide-my-wp.wpwave.com/]
============================================================
Plugin Option
============================================================
{"li":"","import_options":"","export_options":"","debug_report":"","help":"","undo":"","uninstall_hmwp_data":"","hide_wp_login":"","login_query":"hide_my_wp","admin_key":"1234","hide_wp_admin":"","spy_notifier":"","antispam":"","full_hide":"","hide_online_detectors":"","hide_other_wp_files":"","disable_directory_listing":"","disable_canonical_redirect":"","hide_admin_bar":"on","separator":"","custom_404":"0","custom_404_page":"","trusted_user_roles":"","replace_mode":"quick","customized_htaccess":"","cdn_path":"","email_from_name":"","email_from_address":"","avoid_direct_access":"","direct_access_except":"index.php, wp-comments-post.php, wp-includes\/js\/tinymce\/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin\/upgrade.php","exclude_theme_access":"","exclude_plugins_access":"","new_theme_path":"","new_style_name":"","style_expiry_days":"","auto_config_plugins":"","new_include_path":"","new_plugin_path":"","rename_plugins":"","new_upload_path":"","replace_comments_post":"","replace_admin_ajax":"","new_content_path":"","separator2":"","new_login_path":"","new_admin_path":"","separator3":"","api_disable":"0","api_base":"","api_query":"rest_route","author_enable":"1","author_base":"\/author","author_query":"author","author_without_base":"","feed_enable":"1","feed_base":"\/feed","feed_query":"feed","post_enable":"1","post_base":"\/%postname%\/","post_query":"p","page_enable":"1","page_base":"\/","page_query":"page_id","paginate_enable":"1","paginate_base":"\/page","paginate_query":"paged","category_enable":"1","category_base":"","category_query":"cat","tag_enable":"1","tag_base":"","tag_query":"tag","search_enable":"1","search_base":"\/search","search_query":"s","nice_search_redirect":"","disable_archive":"","disable_other_wp":"","remove_html_comments":"","minify_new_style":"","replace_javascript_path":"1","remove_feed_meta":"on","remove_other_meta":"on","remove_default_description":"on","remove_ver_scripts":"","remove_body_class":"","remove_menu_class":"","clean_post_class":"","clean_new_style":"","replace_in_ajax":"","replace_wpnonce":"","disable_xml_rpc":"","internal_css":"","internal_js":"","enable_ids":"on","ids_mode":"0","ids_email":"admin@example.com","ids_level":"0","ids_admin_include":"","ids_cookie":"","logger_link":"","log_ids_min":"5","block_ids_min":"30","email_ids_min":"30","exception_fields":"REQUEST.comment\r\nPOST.comment\r\nREQUEST.permalink_structure\r\nPOST.permalink_structure\r\nREQUEST.selection\r\nPOST.selection\r\nREQUEST.content\r\nPOST.content\r\nREQUEST.__utmz\r\nCOOKIE.__utmz\r\nREQUEST.s_pers\r\nCOOKIE.s_pers\r\nREQUEST.user_pass\r\nPOST.user_pass\r\nREQUEST.pass1\r\nPOST.pass1\r\nREQUEST.pass2\r\nPOST.pass2\r\nREQUEST.password\r\nPOST.password\r\nPOST.hide_my_wp.%\r\nREQUEST.hide_my_wp.%\r\nPOST.%import%\r\nREQUEST.%import%\r\nREQUEST.newcontent\r\nPOST.newcontent\r\nREQUEST.remember_%","ids_html_fields":"","separator4":"","avoid_wp_admin_access":"","allowed_ips_wp_admin_access":"203.0.113.10","trust_network":"on","help_trust_network":"","enable_smwp_server":"","blocked_ips":"","blocked_ip_message":"You are blocked. Please contact site administrator if you think there is a problem. ","blocked_countries":"","allowed_countries":"","replace1":"","replace2":"","new_intrusions_count":0}Provide above report to support team to get better and faster service.
Quick Fix Guide
▸ Video Tutorials
- Make sure you have a writable htaccess file (if you use Apache) or configured your web server manually (if you use Nginx, IIS or enabled multi-site). Follow installation guide for details.
- Disable features which have an asterisk(*) in their names or use a more compatible settings scheme.
- See Frequently Asked Questions for common issues.
- To remove remained WP footprints use Replace Tools
- Use our dedicted Support Forum for other issues
Undo Settings
Click above to restore previous saved settings!
Clean Uninstall
Hiding
Hide Login Page
Login Query
Login parameter for protected login address (default: hide_my_wp) e.g. wp-login.php?hide_my_wp=ADMIN_KEY
Admin Login Key
Current Login url: /wp-login.php?hide_my_wp=1234 (Save changes to update) Want something like "/login"? Change New Login Path (Permalinks tab)
Hide Admin
Spy Notify
Anti-Spam
Full Hide
Hide Online Detectors
Hide Other Files
Directory List
Canonical Redirect
Hide Admin Bar
404 Page Template
Custom 404 Page
We use this as 404 page.
Trusted User Roles
Choose trusted user roles. (Administrator are trusted by default)
Replace Mode
How should we replace old URLs? (Use Full mode with cache)
Customized htaccess
CDN Path
Enter your main CDN address
Email sender nameWill be deprecated in next release.
e.g. John Smith
Email sender addressWill be deprecated in next release.
e.g. info@example.com
Hide PHP Files
Exclude Files
Except these PHP files (or folders). Separate with ,
Exclude Theme
Exclude Plugins
Permalinks
New theme path
e.g. "/template"
New style name
e.g. "main.css" (Require New theme name)
Style Expiry Header
(in days) for browser caching
Auto Configuration
New wp-includes path
e.g. "/lib"
New plugin path
e.g. "/modules"
Rename Plugins
New upload path
e.g. "/file". If your theme or your image plugins uses TimThumb (check source code) read here.
Post Comment
Change "wp_comments_post.php" URL (e.g. "/user_submit" or "/folder/user_submit.php").
AJAX URL
Change wp-admin/admin_ajax.php URL (e.g. "/ajax" or "ajax.php").
New wp-content path
e.g. "/inc" You usually do not need to use it. Only useful for some kinds of plugins (cache, gallery)
Change Login URL
Change wp-login.php e.g. login
New wp-admin Path*
Change "https://uknew.co/wp-admin" (e.g. panel, cp). REQUIRE to update wp-config.php manually
API
API Base
Change "/wp-json/" (e.g. rest, api). NOTE: Please flush the rewrite rule.
API Query
Change /?rest_route=1 (e.g. rest_api).
Author
Author Base
Change "/author/username" (e.g. user, profile, members/editrs/).
Author Query
Change /?author=1 and /?author_name=username (e.g. u, user, member).
Author without base
Feeds
Feed Base
Change /feed (e.g. xml, rss, index.xml).
Feed Query
Change /?feed=rss2 (e.g. xml, rss, sitefeed).
Post
Post Permalink
Post Query
Change /?p=1 (e.g. article_id, news_id or pid).
Page
Page Base
Change /sample-page to /X/sample-page (e.g. pages, static).
Page Query
Change /?page_id=1 or /?page_name=about (e.g. pages).
Paginate
Paginate Base
Change /page/2 (e.g. pages, go).
Paginate Query
Change /?paged=2.
Category
Category Base
Category Query
Change /?cat=1 or /?category_name=uncategorized (e.g. topic).
Tag
Tag Base
Tag Query
Change /?tag=tag1 (e.g. keyword, find).
Search
Search Base
Change /search/keyword (e.g. find, s, dl).
Search Query
Change /?s=keyword (e.g. find, s, dl).
Search base redirect
Disable Archive
Disable Other WP
Protection
Enable IDS
IDS Mode
Alert Email
Send IDS email alerts to this email
Enable IDS For
Monitor potential dangerous requests.
Track Admin
Monitor Cookies
Logs
Log Threshold
Minimium total impact to log the request. 0 to disable logging.
Block Threshold
Minimium total impact to block request with a 404 page. 0 to disable blocking *
Notify Threshold
Minimium total impact to notify you about the request by an email. 0 to disable notifing.
Exception fields
Define fields that will be excluded from PHPIDS. One field per line. e.g. POST.my_field
wildcard example: %.hide_my_wp.% You may need to add each field several times (GET.my_field and REQUEST.my_field)
HTML fields
Define fields that contain HTML and need preparation before hitting the PHPIDS rules. One field per line. Note: Fields must contain valid HTML
Show wp-admin only allowed IP's
Allowed IP's for wp-admin
Separate with , e.g. 203.0.113.3, 203.0.113.*, 198.51.100.1/24
Enable trust network
Participate in Trust Network
Scan My WP Whitelist
Blocked IPs
Separate with , e.g. 203.0.113.3, 203.0.113.*, 198.51.100.1/24 Do not enter your own IP for testing purposes!
Blocked Message
This message will be shown to blocked IPs. HTML is allowed.
Blocked Countries Code
Visitors from these countries will be blocked. Use ISO-2 code list. Separate with , e.g. US, UK, CA. Best result for less than ~100K visits/day
Allowed Countries Code
Only visitors from these countries will be allowed. Use ISO-2 code list. Separate with , e.g. US, UK, CAThis option will override `Blocked Countries Code` Leave blank for allow all countries.
Cleanup
Minify HTML
Remove comments and whitespaces from HTML (Use with cache).
Minify style
Remove theme info and other comments from stylesheet. (Require new style name)(Use with cache!).
Replace \/ URLs
Choose if you see Javascript URLs (e.g. \/wp-content\/themes)
Feed Meta
Other Meta
Default Tagline
Remove Version
Body Classes
Menu Classes
Post Classes
Clean up other
Replace in AJAX
Change Nonce
Disable XML RPC
Internal CSS
Useful to paste internal CSS code (Require New Theme Path)
Internal JS
Useful to paste internal JS code (Require New Theme Path)
Replace
Replace in HTML
Do not use this to change URLs
Use [bslash] for '\'
Base on OSes multiple lines queries may work or not so please check.'
Use [bslash] for '\'
Base on OSes multiple lines queries may work or not so please check.'
Replace URLs
Use this only to change URLs.
Relative path base on WP directory. e.g. wp-content/plugins/woocommerce/assets/css/woocommerce.css Replace ec.css
You can also replace some kind of custom paths
Add '/' at the end of the first path to change all files at the folder.
Relative path base on WP directory. e.g. wp-content/plugins/woocommerce/assets/css/woocommerce.css Replace ec.css
You can also replace some kind of custom paths
Add '/' at the end of the first path to change all files at the folder.
Ansicht für abgemeldete Besucher — Anfragen mit den gespeicherten Einstellungen
302 → 200Weiterleitung zu /wp-login.php
W
Benutzername oder E-Mail-Adresse
Passwort
Angemeldet bleibenAnmeldung
Es geht zur Login-Seite – genau wie bei WordPress im Standard.
302 → 200
W
Benutzername oder E-Mail-Adresse
Passwort
Angemeldet bleibenAnmeldung
Da Hide Admin aus ist, leitet /wp-admin/ zur versteckten Login-URL weiter – der Effekt der geänderten Adresse ist weg.
404
Seite nicht gefunden
404-Seite des Themes
Für nicht angemeldete Besucher sieht /wp-admin/ wie eine nicht vorhandene Seite aus.
200
W
Benutzername oder E-Mail-Adresse
Passwort
Angemeldet bleibenAnmeldung
Die Login-Seite öffnet sich unter der Standard-Login-URL.
404
Seite nicht gefunden
404-Seite des Themes
Da Hide Login Page an ist, liefert die Standard-Login-URL einen 404.
200
W
Benutzername oder E-Mail-Adresse
Passwort
Angemeldet bleibenAnmeldung
Die Login-Seite öffnet sich unter der geänderten Login-URL.
404
Seite nicht gefunden
404-Seite des Themes
Change Login URL ist leer, daher ist diese Adresse eine nicht vorhandene Seite.
200
W
Benutzername oder E-Mail-Adresse
Passwort
Angemeldet bleibenAnmeldung
Die Ersatzadresse mit Login Query und Admin Login Key öffnet die Login-Seite bei jeder Einstellung. Ändere den Schlüssel statt des Standardwerts 1234.
200
faultCode 403
faultString Der Benutzername oder das Passwort ist falsch.
faultString Der Benutzername oder das Passwort ist falsch.
Ist XML-RPC an, antwortet es ohne Umweg über die Login-Seite, ob Benutzername und Passwort stimmen. Eine geänderte Login-URL ändert daran nichts.
405
faultCode 405
faultString Die XML-RPC-Dienste sind auf dieser Website deaktiviert.
faultString Die XML-RPC-Dienste sind auf dieser Website deaktiviert.
Mit Disable XML RPC werden Anfragen, die eine Anmeldung brauchen, abgelehnt.
Auch mit leerem Feld Purchase Code im Tab [Start] wurden die in diesem Beitrag behandelten Einstellungen – Login-URL ändern, Verbergen und XML-RPC ausschalten – gespeichert und funktionierten. Hide My WP ist ein kostenpflichtiges Plugin, das auf CodeCanyon verkauft wird.
2️⃣ Login-URL ändern
Schaltest du im Tab [Hiding] Hide Login Page ein, liefert die Standard-[wp-login.php] einen 404, und sobald du das Häkchen setzt, klappen die Felder Login Query und Admin Login Key auf.
Trägst du im Tab [Permalinks] unter Change Login URL eine neue Adresse wie newlogin ein und speicherst, öffnet sich die Login-Seite unter dieser Adresse. Bleibt die neue Adresse leer, kannst du dich nur über eine Ersatzadresse mit Login Query und Admin Login Key anmelden, etwa [wp-login.php?hide_my_wp=1234]; da diese Ersatzadresse bei jeder Einstellung funktioniert, änderst du den Schlüssel statt des Standardwerts 1234.
3️⃣ Einstellungen Hide Login Page & Hide Admin
Hide Login Page verbirgt die Login-Seite, Hide Admin die Adresse des Adminbereichs, /wp-admin/.
Verbirgst du nur die Login-Seite, leitet WordPress nicht angemeldete Besucher, die /wp-admin/ öffnen, zur geänderten Login-URL weiter – die neue Adresse liegt offen. Das ist, als würdest du den Code der Haustür ändern, während der Pförtner ihn jedem nennt, der fragt.
🧭 Wie die versteckte Login-URL sichtbar wird
Erklär-Diagramm🔐 Hide Login Page
↓
Abgemeldet geöffnet
/wp-login.phpStandard-Login-URL
Login-SeiteNicht vorhandene Seite/newloginGeänderte Login-URL
Login-Seite🛡️ Hide Admin
↓
Abgemeldet geöffnet
/wp-admin/Adresse des Adminbereichs
Weiter zur Login-SeiteWeiter zur neuen Login-URLNicht vorhandene SeiteSind beide Einstellungen aus, verhält es sich wie WordPress im Standard: /wp-admin/ führt zur Login-Seite (302), und auch /wp-login.php öffnet die Login-Seite.
Ist nur Hide Admin an, wird /wp-admin/ zu einer nicht vorhandenen Seite (404), die Standard-Login-URL /wp-login.php öffnet sich aber weiterhin.
Verbirgst du nur die Login-Seite, wird /wp-login.php zu einer nicht vorhandenen Seite (404), doch wer /wp-admin/ öffnet, wird zur geänderten Login-URL weitergeleitet (302) und kennt damit die neue Adresse.
Sind beide an, werden /wp-admin/ und /wp-login.php zu nicht vorhandenen Seiten (404), und nur Administratoren, die die geänderte Adresse kennen, öffnen die Login-Seite.
Schaltest du auch Hide Admin ein, sieht /wp-admin/ für nicht angemeldete Besucher wie eine nicht vorhandene Seite (404) aus, und die neue Login-URL bleibt unbekannt.
4️⃣ XML-RPC ausschalten
Auch mit versteckter Login-URL bleibt [xmlrpc.php] ein weiterer Eingang, der Benutzername und Passwort annimmt.
Schaltest du im Tab [Cleanup] Disable XML RPC ein, werden Anfragen, die eine Anmeldung brauchen, mit 405 und [Die XML-RPC-Dienste sind auf dieser Website deaktiviert.] abgelehnt, die Datei [xmlrpc.php] selbst antwortet aber weiter. Damit Anfragen gar nicht erst bis PHP kommen, sperrst du sie in der Serverkonfiguration.
Manchmal bleibt die Einstellung aktiv, obwohl du das Häkchen bei Disable XML RPC entfernst und speicherst – prüfe nach dem Speichern deshalb noch einmal mit einer echten Antwort.
5️⃣ .htaccess-Regeln, die nach dem Deaktivieren von Hide My WP bleiben
Beim Klick auf [Save Settings] fügt Hide My WP im WordPress-Block der .htaccess eine Regel für die neue Login-URL hinzu.
# .htaccess — Zeile, die nach dem Speichern von Change Login URL als newlogin hinzukommt
RewriteRule ^newlogin /wp-login.php?zV_hide_my_wp=1234 [QSA,L]Auch nach dem Deaktivieren des Plugins blieb diese Zeile in der .htaccess, und die Login-Seite öffnete sich weiter unter der geänderten Adresse. Wenn du das Plugin entfernst, löschst du diese Zeile aus der .htaccess und speicherst.
ℹ️ Affiliate-Hinweis
Die Inhalte dieser Website enthalten Affiliate-Links. Kauft ein Besucher über einen dieser Links ein Produkt oder eine Dienstleistung, erhält die Website vom Verkäufer eine Provision. Der Betrag, den der Käufer zahlt(bei Aktionsrabatten sinkt er ↓), steigt dadurch nicht. Angegebene Preise, Rabatte und Lagerbestände entsprechen dem Stand bei Erstellung und können abweichen; prüfe sie daher vor dem Kauf beim Verkäufer. Produkte werden nach eigenen Kriterien ausgewählt und bewertet, und Provisionen beeinflussen weder die Reihenfolge noch den Inhalt der Bewertungen.