Hide My WP: add-on-beveiligingsplugin voor WordPress | wp-admin & login-URL verbergen en 40+ functies
Hide My WP (Hide My WordPress) wijzigt of verbergt de login-URL van WordPress, wp-admin en de paden van thema's en plugins, en hoort met deze hoofdfuncties en add-ons bij de beveiligingsplugins voor WordPress. Omdat de login-URL van WordPress, wp-admin, voor iedereen zichtbaar is, kun je die verbergen met een beveiligingsplugin die de bescherming versterkt.
Een daarvan is Hide My WP, een betaalde plugin die naast het verbergen van de login-URL en wp-admin zo'n 40 functies ondersteunt, zoals thema- en pluginpaden wijzigen, inbraakdetectie en IP-blokkering, en XML-RPC uitschakelen.
1️⃣ Instellingenscherm van Hide My WP
Het scherm [Settings] van de plugin Hide My WP is verdeeld in zes tabbladen: Start, Hiding, Permalinks, Protection, Cleanup en Replace. De login-URL en het verbergen vind je op de tabbladen [Hiding] en [Permalinks], XML-RPC op het tabblad [Cleanup].
Hide My WP-instellingensimulator
Met [See More] ga je naar de lijst met die logregels.
Op elke regel kun je op [Exclude], [Ban IP], [Delete] en [Filter] klikken.
Met [Whitelist this IP], [Delete] en [Filter by Source] pas je de lijst aan.
[Feedback] gaat naar het externe roadmapadres van de maker, en dat adres toont [Page not found].
[Manual Configuration] opent in een nieuw tabblad de regels die je zelf in .htaccess zet.
Alle velden zijn aan te passen; wijzig de vier gele velden en klik op [Save Settings], dan verandert het scherm van de uitgelogde bezoeker hieronder.
Beheerscherm — Hide My WP › Settings
Item permanently deleted.%s items permanently deleted.Item added to the exceptions list.%s items added to the exceptions list.IP added to the block list.%s IPs added to the block list.IP added to the whitelist.%s IPs added to the whitelist.All logs have been deleted!Search results for “%s”1 item%s itemsPrevious settings have been restored!
Dashboard
Your website may be visible to hackers and detectors. Click on "Show Fixes" to fix 1 issues we have detected.
- Your full hide is disable, Wapplyzer will detect you are using WordPress.
12
Blocked Attack Chart
IDS Attack Blocked
| Name | Value | Impact / Total | IP | Date |
|---|---|---|---|---|
get-file | ../../../../etc/passwd | 25 / 50 | 198.51.100.44 | Oct 13 2026 |
request-file | ../../../../etc/passwd | 25 / 50 | 198.51.100.44 | Oct 13 2026 |
get-id | 1' UNION SELECT user_login,user_pass FROM wp_users-- | 34 / 68 | 198.51.100.9 | Oct 13 2026 |
request-id | 1' UNION SELECT user_login,user_pass FROM wp_users-- | 34 / 68 | 198.51.100.9 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.140 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.140 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.77 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.77 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.25 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.25 | Oct 13 2026 |
5
IP Blocked Attack Chart
IP Attack Blocked
| IP | Date |
|---|---|
203.0.113.10 | Oct 09 2026 |
198.51.100.44 | Oct 10 2026 |
203.0.113.140 | Oct 11 2026 |
198.51.100.9 | Oct 12 2026 |
203.0.113.25 | Oct 13 2026 |
HMWP IDS Log
| Name | Value | Page | Impact / Total | IP / User | Date | |
|---|---|---|---|---|---|---|
| GET.file | | | ../../../../etc/passwd | /?file=../../../../etc/passwd | 25 / 50 | 198.51.100.44 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.file | | | ../../../../etc/passwd | /?file=../../../../etc/passwd | 25 / 50 | 198.51.100.44 Guest KR | October 13, 2026 2:16 pm | |
| GET.id | | | 1' UNION SELECT user_logi... 1' UNION SELECT user_login,user_pass FROM wp_users-- | /?id=1%27%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users-- | 34 / 68 | 198.51.100.9 Guest | October 13, 2026 2:16 pm | |
| REQUEST.id | | | 1' UNION SELECT user_logi... 1' UNION SELECT user_login,user_pass FROM wp_users-- | /?id=1%27%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users-- | 34 / 68 | 198.51.100.9 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.140 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.140 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.77 Guest | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.77 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest | October 13, 2026 2:16 pm | |
| Name | Value | Page | Impact / Total | IP / User | Date |
* Value is sanitized for your safety
How good is that, no intrusions.
No intrusions found.
HMWP Blocked IP Addresses
(5) | (4) | (1)
5 items
| 203.0.113.10 | | October 9, 2026 6:30 pm | ||
| 198.51.100.44 | | Outside Allowed Countries | October 10, 2026 3:17 am | |
| 203.0.113.140 | | Blocked Countries | October 11, 2026 10:05 pm | |
| 198.51.100.9 | | Trust Network | October 12, 2026 9:41 am | |
| 203.0.113.25 | | Manual Blocking | October 13, 2026 2:20 pm | |
| No items found. | |||
Manual Configuration
In rare cases you need to configure it manually.
- If you use BulletProof Security plugin, first secure the htaccess file using it and then add the following lines to your htaccess file using FTP.
- You may need to reconfigure the server whenever you change settings or activate a new theme or plugin.
- Add these lines right before: RewriteCond %{REQUEST_FILENAME} !-f. Next, you may want to change htaccess permission to read-only (e.g., 666)
Nothing to add for current settings!
Hide My WP
Settings was updated successfully!
Start
Purchase Code
Enter your Purchase Code to make sure everything work as expected. Get it.
Import Options
Paste your settings code below or choose a pre-made settings scheme.
Export Options
Copy your export code and save it somewhere for later use.
Copy your export code and save it somewhere for later use.
{"li":"","import_options":"","export_options":"","debug_report":"","help":"","undo":"","uninstall_hmwp_data":"","hide_wp_login":"","login_query":"hide_my_wp","admin_key":"1234","hide_wp_admin":"","spy_notifier":"","antispam":"","full_hide":"","hide_online_detectors":"","hide_other_wp_files":"","disable_directory_listing":"","disable_canonical_redirect":"","hide_admin_bar":"on","separator":"","custom_404":"0","custom_404_page":"","trusted_user_roles":"","replace_mode":"quick","customized_htaccess":"","cdn_path":"","email_from_name":"","email_from_address":"","avoid_direct_access":"","direct_access_except":"index.php, wp-comments-post.php, wp-includes/js/tinymce/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin/upgrade.php","exclude_theme_access":"","exclude_plugins_access":"","new_theme_path":"","new_style_name":"","style_expiry_days":"","auto_config_plugins":"","new_include_path":"","new_plugin_path":"","rename_plugins":"","new_upload_path":"","replace_comments_post":"","replace_admin_ajax":"","new_content_path":"","separator2":"","new_login_path":"","new_admin_path":"","separator3":"","api_disable":"0","api_base":"","api_query":"rest_route","author_enable":"1","author_base":"/author","author_query":"author","author_without_base":"","feed_enable":"1","feed_base":"/feed","feed_query":"feed","post_enable":"1","post_base":"/%postname%/","post_query":"p","page_enable":"1","page_base":"/","page_query":"page_id","paginate_enable":"1","paginate_base":"/page","paginate_query":"paged","category_enable":"1","category_base":"","category_query":"cat","tag_enable":"1","tag_base":"","tag_query":"tag","search_enable":"1","search_base":"/search","search_query":"s","nice_search_redirect":"","disable_archive":"","disable_other_wp":"","remove_html_comments":"","minify_new_style":"","replace_javascript_path":"1","remove_feed_meta":"on","remove_other_meta":"on","remove_default_description":"on","remove_ver_scripts":"","remove_body_class":"","remove_menu_class":"","clean_post_class":"","clean_new_style":"","replace_in_ajax":"","replace_wpnonce":"","disable_xml_rpc":"","internal_css":"","internal_js":"","enable_ids":"on","ids_mode":"0","ids_email":"admin@example.com","ids_level":"0","ids_admin_include":"","ids_cookie":"","logger_link":"","log_ids_min":"5","block_ids_min":"30","email_ids_min":"30","exception_fields":"REQUEST.comment[new_line]POST.comment[new_line]REQUEST.permalink_structure[new_line]POST.permalink_structure[new_line]REQUEST.selection[new_line]POST.selection[new_line]REQUEST.content[new_line]POST.content[new_line]REQUEST.__utmz[new_line]COOKIE.__utmz[new_line]REQUEST.s_pers[new_line]COOKIE.s_pers[new_line]REQUEST.user_pass[new_line]POST.user_pass[new_line]REQUEST.pass1[new_line]POST.pass1[new_line]REQUEST.pass2[new_line]POST.pass2[new_line]REQUEST.password[new_line]POST.password[new_line]POST.hide_my_wp.%[new_line]REQUEST.hide_my_wp.%[new_line]POST.%import%[new_line]REQUEST.%import%[new_line]REQUEST.newcontent[new_line]POST.newcontent[new_line]REQUEST.remember_%","ids_html_fields":"","separator4":"","avoid_wp_admin_access":"","allowed_ips_wp_admin_access":"203.0.113.10","trust_network":"on","help_trust_network":"","enable_smwp_server":"","blocked_ips":"","blocked_ip_message":"You are blocked. Please contact site administrator if you think there is a problem. ","blocked_countries":"","allowed_countries":"","replace1":"","replace2":"","new_intrusions_count":"0"}Debug Report
Provide above report to support team to get better and faster service.
===========================================================
WP Settings
===========================================================
WordPress version: WP 7.1.3
Home URL: https://example.com
Site URL: https://example.com
Is SSL: true
Is RTL: false
Permalink: /%postname%/
============================================================
Server Environment
============================================================
PHP Version: 8.3
Server Software: Apache
WP Max Upload Size: 2 GB
Server upload_max_filesize: 2048M
Server post_max_size: 2048M
WP Memory Limit: 40M
WP Debug Mode: false
CURL: true
fsockopen: true
============================================================
Active plugins
============================================================
Hide My WP 6.2.12 [http://hide-my-wp.wpwave.com/]
============================================================
Plugin Option
============================================================
{"li":"","import_options":"","export_options":"","debug_report":"","help":"","undo":"","uninstall_hmwp_data":"","hide_wp_login":"","login_query":"hide_my_wp","admin_key":"1234","hide_wp_admin":"","spy_notifier":"","antispam":"","full_hide":"","hide_online_detectors":"","hide_other_wp_files":"","disable_directory_listing":"","disable_canonical_redirect":"","hide_admin_bar":"on","separator":"","custom_404":"0","custom_404_page":"","trusted_user_roles":"","replace_mode":"quick","customized_htaccess":"","cdn_path":"","email_from_name":"","email_from_address":"","avoid_direct_access":"","direct_access_except":"index.php, wp-comments-post.php, wp-includes\/js\/tinymce\/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin\/upgrade.php","exclude_theme_access":"","exclude_plugins_access":"","new_theme_path":"","new_style_name":"","style_expiry_days":"","auto_config_plugins":"","new_include_path":"","new_plugin_path":"","rename_plugins":"","new_upload_path":"","replace_comments_post":"","replace_admin_ajax":"","new_content_path":"","separator2":"","new_login_path":"","new_admin_path":"","separator3":"","api_disable":"0","api_base":"","api_query":"rest_route","author_enable":"1","author_base":"\/author","author_query":"author","author_without_base":"","feed_enable":"1","feed_base":"\/feed","feed_query":"feed","post_enable":"1","post_base":"\/%postname%\/","post_query":"p","page_enable":"1","page_base":"\/","page_query":"page_id","paginate_enable":"1","paginate_base":"\/page","paginate_query":"paged","category_enable":"1","category_base":"","category_query":"cat","tag_enable":"1","tag_base":"","tag_query":"tag","search_enable":"1","search_base":"\/search","search_query":"s","nice_search_redirect":"","disable_archive":"","disable_other_wp":"","remove_html_comments":"","minify_new_style":"","replace_javascript_path":"1","remove_feed_meta":"on","remove_other_meta":"on","remove_default_description":"on","remove_ver_scripts":"","remove_body_class":"","remove_menu_class":"","clean_post_class":"","clean_new_style":"","replace_in_ajax":"","replace_wpnonce":"","disable_xml_rpc":"","internal_css":"","internal_js":"","enable_ids":"on","ids_mode":"0","ids_email":"admin@example.com","ids_level":"0","ids_admin_include":"","ids_cookie":"","logger_link":"","log_ids_min":"5","block_ids_min":"30","email_ids_min":"30","exception_fields":"REQUEST.comment\r\nPOST.comment\r\nREQUEST.permalink_structure\r\nPOST.permalink_structure\r\nREQUEST.selection\r\nPOST.selection\r\nREQUEST.content\r\nPOST.content\r\nREQUEST.__utmz\r\nCOOKIE.__utmz\r\nREQUEST.s_pers\r\nCOOKIE.s_pers\r\nREQUEST.user_pass\r\nPOST.user_pass\r\nREQUEST.pass1\r\nPOST.pass1\r\nREQUEST.pass2\r\nPOST.pass2\r\nREQUEST.password\r\nPOST.password\r\nPOST.hide_my_wp.%\r\nREQUEST.hide_my_wp.%\r\nPOST.%import%\r\nREQUEST.%import%\r\nREQUEST.newcontent\r\nPOST.newcontent\r\nREQUEST.remember_%","ids_html_fields":"","separator4":"","avoid_wp_admin_access":"","allowed_ips_wp_admin_access":"203.0.113.10","trust_network":"on","help_trust_network":"","enable_smwp_server":"","blocked_ips":"","blocked_ip_message":"You are blocked. Please contact site administrator if you think there is a problem. ","blocked_countries":"","allowed_countries":"","replace1":"","replace2":"","new_intrusions_count":0}Provide above report to support team to get better and faster service.
Quick Fix Guide
▸ Video Tutorials
- Make sure you have a writable htaccess file (if you use Apache) or configured your web server manually (if you use Nginx, IIS or enabled multi-site). Follow installation guide for details.
- Disable features which have an asterisk(*) in their names or use a more compatible settings scheme.
- See Frequently Asked Questions for common issues.
- To remove remained WP footprints use Replace Tools
- Use our dedicted Support Forum for other issues
Undo Settings
Click above to restore previous saved settings!
Clean Uninstall
Hiding
Hide Login Page
Login Query
Login parameter for protected login address (default: hide_my_wp) e.g. wp-login.php?hide_my_wp=ADMIN_KEY
Admin Login Key
Current Login url: /wp-login.php?hide_my_wp=1234 (Save changes to update) Want something like "/login"? Change New Login Path (Permalinks tab)
Hide Admin
Spy Notify
Anti-Spam
Full Hide
Hide Online Detectors
Hide Other Files
Directory List
Canonical Redirect
Hide Admin Bar
404 Page Template
Custom 404 Page
We use this as 404 page.
Trusted User Roles
Choose trusted user roles. (Administrator are trusted by default)
Replace Mode
How should we replace old URLs? (Use Full mode with cache)
Customized htaccess
CDN Path
Enter your main CDN address
Email sender nameWill be deprecated in next release.
e.g. John Smith
Email sender addressWill be deprecated in next release.
e.g. info@example.com
Hide PHP Files
Exclude Files
Except these PHP files (or folders). Separate with ,
Exclude Theme
Exclude Plugins
Permalinks
New theme path
e.g. "/template"
New style name
e.g. "main.css" (Require New theme name)
Style Expiry Header
(in days) for browser caching
Auto Configuration
New wp-includes path
e.g. "/lib"
New plugin path
e.g. "/modules"
Rename Plugins
New upload path
e.g. "/file". If your theme or your image plugins uses TimThumb (check source code) read here.
Post Comment
Change "wp_comments_post.php" URL (e.g. "/user_submit" or "/folder/user_submit.php").
AJAX URL
Change wp-admin/admin_ajax.php URL (e.g. "/ajax" or "ajax.php").
New wp-content path
e.g. "/inc" You usually do not need to use it. Only useful for some kinds of plugins (cache, gallery)
Change Login URL
Change wp-login.php e.g. login
New wp-admin Path*
Change "https://uknew.co/wp-admin" (e.g. panel, cp). REQUIRE to update wp-config.php manually
API
API Base
Change "/wp-json/" (e.g. rest, api). NOTE: Please flush the rewrite rule.
API Query
Change /?rest_route=1 (e.g. rest_api).
Author
Author Base
Change "/author/username" (e.g. user, profile, members/editrs/).
Author Query
Change /?author=1 and /?author_name=username (e.g. u, user, member).
Author without base
Feeds
Feed Base
Change /feed (e.g. xml, rss, index.xml).
Feed Query
Change /?feed=rss2 (e.g. xml, rss, sitefeed).
Post
Post Permalink
Post Query
Change /?p=1 (e.g. article_id, news_id or pid).
Page
Page Base
Change /sample-page to /X/sample-page (e.g. pages, static).
Page Query
Change /?page_id=1 or /?page_name=about (e.g. pages).
Paginate
Paginate Base
Change /page/2 (e.g. pages, go).
Paginate Query
Change /?paged=2.
Category
Category Base
Category Query
Change /?cat=1 or /?category_name=uncategorized (e.g. topic).
Tag
Tag Base
Tag Query
Change /?tag=tag1 (e.g. keyword, find).
Search
Search Base
Change /search/keyword (e.g. find, s, dl).
Search Query
Change /?s=keyword (e.g. find, s, dl).
Search base redirect
Disable Archive
Disable Other WP
Protection
Enable IDS
IDS Mode
Alert Email
Send IDS email alerts to this email
Enable IDS For
Monitor potential dangerous requests.
Track Admin
Monitor Cookies
Logs
Log Threshold
Minimium total impact to log the request. 0 to disable logging.
Block Threshold
Minimium total impact to block request with a 404 page. 0 to disable blocking *
Notify Threshold
Minimium total impact to notify you about the request by an email. 0 to disable notifing.
Exception fields
Define fields that will be excluded from PHPIDS. One field per line. e.g. POST.my_field
wildcard example: %.hide_my_wp.% You may need to add each field several times (GET.my_field and REQUEST.my_field)
HTML fields
Define fields that contain HTML and need preparation before hitting the PHPIDS rules. One field per line. Note: Fields must contain valid HTML
Show wp-admin only allowed IP's
Allowed IP's for wp-admin
Separate with , e.g. 203.0.113.3, 203.0.113.*, 198.51.100.1/24
Enable trust network
Participate in Trust Network
Scan My WP Whitelist
Blocked IPs
Separate with , e.g. 203.0.113.3, 203.0.113.*, 198.51.100.1/24 Do not enter your own IP for testing purposes!
Blocked Message
This message will be shown to blocked IPs. HTML is allowed.
Blocked Countries Code
Visitors from these countries will be blocked. Use ISO-2 code list. Separate with , e.g. US, UK, CA. Best result for less than ~100K visits/day
Allowed Countries Code
Only visitors from these countries will be allowed. Use ISO-2 code list. Separate with , e.g. US, UK, CAThis option will override `Blocked Countries Code` Leave blank for allow all countries.
Cleanup
Minify HTML
Remove comments and whitespaces from HTML (Use with cache).
Minify style
Remove theme info and other comments from stylesheet. (Require new style name)(Use with cache!).
Replace \/ URLs
Choose if you see Javascript URLs (e.g. \/wp-content\/themes)
Feed Meta
Other Meta
Default Tagline
Remove Version
Body Classes
Menu Classes
Post Classes
Clean up other
Replace in AJAX
Change Nonce
Disable XML RPC
Internal CSS
Useful to paste internal CSS code (Require New Theme Path)
Internal JS
Useful to paste internal JS code (Require New Theme Path)
Replace
Replace in HTML
Do not use this to change URLs
Use [bslash] for '\'
Base on OSes multiple lines queries may work or not so please check.'
Use [bslash] for '\'
Base on OSes multiple lines queries may work or not so please check.'
Replace URLs
Use this only to change URLs.
Relative path base on WP directory. e.g. wp-content/plugins/woocommerce/assets/css/woocommerce.css Replace ec.css
You can also replace some kind of custom paths
Add '/' at the end of the first path to change all files at the folder.
Relative path base on WP directory. e.g. wp-content/plugins/woocommerce/assets/css/woocommerce.css Replace ec.css
You can also replace some kind of custom paths
Add '/' at the end of the first path to change all files at the folder.
Scherm van een uitgelogde bezoeker — verzoeken met de opgeslagen instellingen
302 → 200Doorverwijzing naar /wp-login.php
W
Gebruikersnaam of e-mailadres
Wachtwoord
Onthoud mijInloggen
Je komt op het inlogscherm, net als bij standaard-WordPress.
302 → 200
W
Gebruikersnaam of e-mailadres
Wachtwoord
Onthoud mijInloggen
Omdat Hide Admin uit staat, verwijst /wp-admin/ door naar de verborgen login-URL. Het effect van de gewijzigde URL verdwijnt.
404
Pagina niet gevonden
404-pagina van het thema
Voor bezoekers die niet zijn ingelogd, lijkt /wp-admin/ een pagina die niet bestaat.
200
W
Gebruikersnaam of e-mailadres
Wachtwoord
Onthoud mijInloggen
Het inlogscherm opent op de standaard login-URL.
404
Pagina niet gevonden
404-pagina van het thema
Omdat Hide Login Page aan staat, geeft de standaard login-URL een 404.
200
W
Gebruikersnaam of e-mailadres
Wachtwoord
Onthoud mijInloggen
Het inlogscherm opent op de gewijzigde login-URL.
404
Pagina niet gevonden
404-pagina van het thema
Change Login URL is leeg, dus deze URL is een pagina die niet bestaat.
200
W
Gebruikersnaam of e-mailadres
Wachtwoord
Onthoud mijInloggen
Het reserveadres met Login Query en Admin Login Key opent bij elke instelling het inlogscherm. Vervang de sleutelwaarde door iets anders dan de standaardwaarde 1234.
200
faultCode 403
faultString Ongeldig(e) gebruikersnaam of wachtwoord.
faultString Ongeldig(e) gebruikersnaam of wachtwoord.
Staat XML-RPC aan, dan antwoordt het of gebruikersnaam en wachtwoord kloppen, zonder via het inlogscherm te gaan. Een gewijzigde login-URL verandert daar niets aan.
405
faultCode 405
faultString XML-RPC diensten zijn uitgeschakeld voor deze site.
faultString XML-RPC diensten zijn uitgeschakeld voor deze site.
Zet je Disable XML RPC aan, dan worden verzoeken waarvoor inloggen nodig is geweigerd.
Ook met het veld Purchase Code op het tabblad [Start] leeg werden de instellingen uit dit artikel – login-URL wijzigen, verbergen en XML-RPC uitschakelen – opgeslagen en werkten ze. Hide My WP is een betaalde plugin die op CodeCanyon wordt verkocht.
2️⃣ De login-URL wijzigen
Zet je op het tabblad [Hiding] Hide Login Page aan, dan geeft de standaard [wp-login.php] een 404, en zodra je het vinkje zet, klappen de velden Login Query en Admin Login Key open.
Vul je op het tabblad [Permalinks] bij Change Login URL een nieuw adres in, zoals newlogin, en sla je op, dan opent het inlogscherm op dat adres. Laat je het nieuwe adres leeg, dan kun je alleen inloggen via een reserveadres met Login Query en Admin Login Key, zoals [wp-login.php?hide_my_wp=1234]; omdat dit reserveadres bij elke instelling opent, vervang je de sleutelwaarde door iets anders dan de standaardwaarde 1234.
3️⃣ Instellingen Hide Login Page & Hide Admin
Hide Login Page verbergt het inlogscherm, Hide Admin het adres van het beheerscherm, /wp-admin/.
Verberg je alleen het inlogscherm, dan stuurt WordPress een niet-ingelogde bezoeker die /wp-admin/ opent door naar de gewijzigde login-URL, zodat het nieuwe adres gewoon zichtbaar wordt. Het is alsof je de code van de voordeur verandert, terwijl de portier de nieuwe code geeft aan iedereen die ernaar vraagt.
🧭 Hoe een verborgen login-URL uitlekt
Uitlegdiagram🔐 Hide Login Page
↓
Uitgelogd geopend
/wp-login.phpStandaard login-URL
InlogschermNiet-bestaande pagina/newloginGewijzigde login-URL
Inlogscherm🛡️ Hide Admin
↓
Uitgelogd geopend
/wp-admin/Adres van het beheerscherm
Naar het inlogschermNaar de nieuwe login-URLNiet-bestaande paginaMet beide instellingen uit is het hetzelfde als standaard-WordPress: /wp-admin/ gaat naar het inlogscherm (302), en ook /wp-login.php opent het inlogscherm.
Met alleen Hide Admin aan wordt /wp-admin/ een niet-bestaande pagina (404), maar de standaard login-URL /wp-login.php opent nog steeds.
Verberg je alleen het inlogscherm, dan wordt /wp-login.php een niet-bestaande pagina (404), maar een bezoeker die /wp-admin/ opent, wordt doorgestuurd naar de gewijzigde login-URL (302) en kent zo het nieuwe adres.
Met beide instellingen aan worden /wp-admin/ en /wp-login.php allebei niet-bestaande pagina's (404), en alleen een beheerder die het gewijzigde adres kent, opent het inlogscherm.
Zet je ook Hide Admin aan, dan lijkt /wp-admin/ voor niet-ingelogde bezoekers een niet-bestaande pagina (404), en is de nieuwe login-URL niet te achterhalen.
4️⃣ XML-RPC uitschakelen
Ook met een verborgen login-URL blijft [xmlrpc.php] een tweede ingang die een gebruikersnaam en wachtwoord aanneemt.
Zet je op het tabblad [Cleanup] Disable XML RPC aan, dan worden verzoeken waarvoor inloggen nodig is geweigerd met een 405 en [XML-RPC diensten zijn uitgeschakeld voor deze site.], maar het bestand [xmlrpc.php] zelf blijft antwoorden. Wil je dat verzoeken PHP niet bereiken, blokkeer het dan in de serverconfiguratie.
Soms blijft de instelling aan, ook als je het vinkje bij Disable XML RPC weghaalt en opslaat; controleer daarom na het opslaan nog een keer met een echt antwoord.
5️⃣ .htaccess-regels die achterblijven na het deactiveren van Hide My WP
Als je op [Save Settings] klikt, voegt Hide My WP binnen het WordPress-blok van .htaccess een regel voor de nieuwe login-URL toe.
# .htaccess — regel die is toegevoegd na het opslaan van Change Login URL als newlogin
RewriteRule ^newlogin /wp-login.php?zV_hide_my_wp=1234 [QSA,L]Ook na het deactiveren van de plugin bleef deze regel in .htaccess staan, en het inlogscherm bleef openen op het gewijzigde adres. Ruim je de plugin op, verwijder deze regel dan uit .htaccess en sla op.
ℹ️ Affiliatemelding
De content van deze site bevat affiliatelinks. Koopt een bezoeker via een van deze links een product of dienst, dan ontvangt deze site een commissie van de verkoper. Het bedrag dat de koper betaalt (bij acties gaat het omlaag ↓) wordt daardoor niet hoger. De vermelde prijzen, kortingen en voorraad gelden op het moment van schrijven en kunnen afwijken; controleer ze daarom vóór je aankoop bij de verkoper. Producten worden gekozen en beoordeeld volgens onze eigen criteria, en commissies hebben geen invloed op de volgorde of de inhoud van de beoordelingen.