Hide My WP: wtyczka bezpieczeństwa Add-on dla WordPressa | ukrywanie wp-admin & adresu logowania i ponad 40 funkcji
Hide My WP (Hide My WordPress) zmienia lub ukrywa adres logowania WordPressa, wp-admin oraz ścieżki motywów i wtyczek, a dzięki tym głównym funkcjom i dodatkom można go zaliczyć do wtyczek bezpieczeństwa WordPressa. Ponieważ adres logowania WordPressa, wp-admin, jest widoczny dla wszystkich, możesz go ukryć wtyczką bezpieczeństwa, która wzmacnia ochronę.
Wśród nich Hide My WP to płatna wtyczka, która oprócz ukrywania adresu logowania i wp-admin oferuje około 40 funkcji, takich jak zmiana ścieżek motywów i wtyczek, wykrywanie włamań i blokowanie IP czy wyłączanie XML-RPC.
1️⃣ Ekran ustawień Hide My WP
Ekran [Settings] wtyczki Hide My WP dzieli się na sześć kart: Start, Hiding, Permalinks, Protection, Cleanup i Replace. Adres logowania i ukrywanie znajdziesz na kartach [Hiding] i [Permalinks], a XML-RPC na karcie [Cleanup].
Symulator ustawień Hide My WP
Po kliknięciu [See More] przejdziesz do listy tych wpisów.
W każdym wierszu możesz kliknąć [Exclude], [Ban IP], [Delete] i [Filter].
Przyciskami [Whitelist this IP], [Delete] i [Filter by Source] zmienisz listę.
[Feedback] prowadzi do zewnętrznego adresu roadmapy producenta, a ten adres pokazuje [Page not found].
[Manual Configuration] otwiera w nowej karcie reguły do ręcznego wpisania w .htaccess.
Wszystkie pola można zmieniać; zmień cztery żółte pola i kliknij [Save Settings], a ekran niezalogowanego odwiedzającego poniżej się zmieni.
Panel administracyjny — Hide My WP › Settings
Item permanently deleted.%s items permanently deleted.Item added to the exceptions list.%s items added to the exceptions list.IP added to the block list.%s IPs added to the block list.IP added to the whitelist.%s IPs added to the whitelist.All logs have been deleted!Search results for “%s”1 item%s itemsPrevious settings have been restored!
Dashboard
Your website may be visible to hackers and detectors. Click on "Show Fixes" to fix 1 issues we have detected.
- Your full hide is disable, Wapplyzer will detect you are using WordPress.
12
Blocked Attack Chart
IDS Attack Blocked
| Name | Value | Impact / Total | IP | Date |
|---|---|---|---|---|
get-file | ../../../../etc/passwd | 25 / 50 | 198.51.100.44 | Oct 13 2026 |
request-file | ../../../../etc/passwd | 25 / 50 | 198.51.100.44 | Oct 13 2026 |
get-id | 1' UNION SELECT user_login,user_pass FROM wp_users-- | 34 / 68 | 198.51.100.9 | Oct 13 2026 |
request-id | 1' UNION SELECT user_login,user_pass FROM wp_users-- | 34 / 68 | 198.51.100.9 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.140 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.140 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.77 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.77 | Oct 13 2026 |
get-s | alert(document.cookie) | 25 / 50 | 203.0.113.25 | Oct 13 2026 |
request-s | alert(document.cookie) | 25 / 50 | 203.0.113.25 | Oct 13 2026 |
5
IP Blocked Attack Chart
IP Attack Blocked
| IP | Date |
|---|---|
203.0.113.10 | Oct 09 2026 |
198.51.100.44 | Oct 10 2026 |
203.0.113.140 | Oct 11 2026 |
198.51.100.9 | Oct 12 2026 |
203.0.113.25 | Oct 13 2026 |
HMWP IDS Log
| Name | Value | Page | Impact / Total | IP / User | Date | |
|---|---|---|---|---|---|---|
| GET.file | | | ../../../../etc/passwd | /?file=../../../../etc/passwd | 25 / 50 | 198.51.100.44 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.file | | | ../../../../etc/passwd | /?file=../../../../etc/passwd | 25 / 50 | 198.51.100.44 Guest KR | October 13, 2026 2:16 pm | |
| GET.id | | | 1' UNION SELECT user_logi... 1' UNION SELECT user_login,user_pass FROM wp_users-- | /?id=1%27%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users-- | 34 / 68 | 198.51.100.9 Guest | October 13, 2026 2:16 pm | |
| REQUEST.id | | | 1' UNION SELECT user_logi... 1' UNION SELECT user_login,user_pass FROM wp_users-- | /?id=1%27%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users-- | 34 / 68 | 198.51.100.9 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.140 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.140 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.77 Guest | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.77 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest KR | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest KR | October 13, 2026 2:16 pm | |
| GET.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest | October 13, 2026 2:16 pm | |
| REQUEST.s | | | alert(document.cookie) | /?s=%3Cscript%3Ealert(document.cookie)%3C/script%3E | 25 / 50 | 203.0.113.25 Guest | October 13, 2026 2:16 pm | |
| Name | Value | Page | Impact / Total | IP / User | Date |
* Value is sanitized for your safety
How good is that, no intrusions.
No intrusions found.
HMWP Blocked IP Addresses
(5) | (4) | (1)
5 items
| 203.0.113.10 | | October 9, 2026 6:30 pm | ||
| 198.51.100.44 | | Outside Allowed Countries | October 10, 2026 3:17 am | |
| 203.0.113.140 | | Blocked Countries | October 11, 2026 10:05 pm | |
| 198.51.100.9 | | Trust Network | October 12, 2026 9:41 am | |
| 203.0.113.25 | | Manual Blocking | October 13, 2026 2:20 pm | |
| No items found. | |||
Manual Configuration
In rare cases you need to configure it manually.
- If you use BulletProof Security plugin, first secure the htaccess file using it and then add the following lines to your htaccess file using FTP.
- You may need to reconfigure the server whenever you change settings or activate a new theme or plugin.
- Add these lines right before: RewriteCond %{REQUEST_FILENAME} !-f. Next, you may want to change htaccess permission to read-only (e.g., 666)
Nothing to add for current settings!
Hide My WP
Settings was updated successfully!
Start
Purchase Code
Enter your Purchase Code to make sure everything work as expected. Get it.
Import Options
Paste your settings code below or choose a pre-made settings scheme.
Export Options
Copy your export code and save it somewhere for later use.
Copy your export code and save it somewhere for later use.
{"li":"","import_options":"","export_options":"","debug_report":"","help":"","undo":"","uninstall_hmwp_data":"","hide_wp_login":"","login_query":"hide_my_wp","admin_key":"1234","hide_wp_admin":"","spy_notifier":"","antispam":"","full_hide":"","hide_online_detectors":"","hide_other_wp_files":"","disable_directory_listing":"","disable_canonical_redirect":"","hide_admin_bar":"on","separator":"","custom_404":"0","custom_404_page":"","trusted_user_roles":"","replace_mode":"quick","customized_htaccess":"","cdn_path":"","email_from_name":"","email_from_address":"","avoid_direct_access":"","direct_access_except":"index.php, wp-comments-post.php, wp-includes/js/tinymce/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin/upgrade.php","exclude_theme_access":"","exclude_plugins_access":"","new_theme_path":"","new_style_name":"","style_expiry_days":"","auto_config_plugins":"","new_include_path":"","new_plugin_path":"","rename_plugins":"","new_upload_path":"","replace_comments_post":"","replace_admin_ajax":"","new_content_path":"","separator2":"","new_login_path":"","new_admin_path":"","separator3":"","api_disable":"0","api_base":"","api_query":"rest_route","author_enable":"1","author_base":"/author","author_query":"author","author_without_base":"","feed_enable":"1","feed_base":"/feed","feed_query":"feed","post_enable":"1","post_base":"/%postname%/","post_query":"p","page_enable":"1","page_base":"/","page_query":"page_id","paginate_enable":"1","paginate_base":"/page","paginate_query":"paged","category_enable":"1","category_base":"","category_query":"cat","tag_enable":"1","tag_base":"","tag_query":"tag","search_enable":"1","search_base":"/search","search_query":"s","nice_search_redirect":"","disable_archive":"","disable_other_wp":"","remove_html_comments":"","minify_new_style":"","replace_javascript_path":"1","remove_feed_meta":"on","remove_other_meta":"on","remove_default_description":"on","remove_ver_scripts":"","remove_body_class":"","remove_menu_class":"","clean_post_class":"","clean_new_style":"","replace_in_ajax":"","replace_wpnonce":"","disable_xml_rpc":"","internal_css":"","internal_js":"","enable_ids":"on","ids_mode":"0","ids_email":"admin@example.com","ids_level":"0","ids_admin_include":"","ids_cookie":"","logger_link":"","log_ids_min":"5","block_ids_min":"30","email_ids_min":"30","exception_fields":"REQUEST.comment[new_line]POST.comment[new_line]REQUEST.permalink_structure[new_line]POST.permalink_structure[new_line]REQUEST.selection[new_line]POST.selection[new_line]REQUEST.content[new_line]POST.content[new_line]REQUEST.__utmz[new_line]COOKIE.__utmz[new_line]REQUEST.s_pers[new_line]COOKIE.s_pers[new_line]REQUEST.user_pass[new_line]POST.user_pass[new_line]REQUEST.pass1[new_line]POST.pass1[new_line]REQUEST.pass2[new_line]POST.pass2[new_line]REQUEST.password[new_line]POST.password[new_line]POST.hide_my_wp.%[new_line]REQUEST.hide_my_wp.%[new_line]POST.%import%[new_line]REQUEST.%import%[new_line]REQUEST.newcontent[new_line]POST.newcontent[new_line]REQUEST.remember_%","ids_html_fields":"","separator4":"","avoid_wp_admin_access":"","allowed_ips_wp_admin_access":"203.0.113.10","trust_network":"on","help_trust_network":"","enable_smwp_server":"","blocked_ips":"","blocked_ip_message":"You are blocked. Please contact site administrator if you think there is a problem. ","blocked_countries":"","allowed_countries":"","replace1":"","replace2":"","new_intrusions_count":"0"}Debug Report
Provide above report to support team to get better and faster service.
===========================================================
WP Settings
===========================================================
WordPress version: WP 7.1.3
Home URL: https://example.com
Site URL: https://example.com
Is SSL: true
Is RTL: false
Permalink: /%postname%/
============================================================
Server Environment
============================================================
PHP Version: 8.3
Server Software: Apache
WP Max Upload Size: 2 GB
Server upload_max_filesize: 2048M
Server post_max_size: 2048M
WP Memory Limit: 40M
WP Debug Mode: false
CURL: true
fsockopen: true
============================================================
Active plugins
============================================================
Hide My WP 6.2.12 [http://hide-my-wp.wpwave.com/]
============================================================
Plugin Option
============================================================
{"li":"","import_options":"","export_options":"","debug_report":"","help":"","undo":"","uninstall_hmwp_data":"","hide_wp_login":"","login_query":"hide_my_wp","admin_key":"1234","hide_wp_admin":"","spy_notifier":"","antispam":"","full_hide":"","hide_online_detectors":"","hide_other_wp_files":"","disable_directory_listing":"","disable_canonical_redirect":"","hide_admin_bar":"on","separator":"","custom_404":"0","custom_404_page":"","trusted_user_roles":"","replace_mode":"quick","customized_htaccess":"","cdn_path":"","email_from_name":"","email_from_address":"","avoid_direct_access":"","direct_access_except":"index.php, wp-comments-post.php, wp-includes\/js\/tinymce\/wp-tinymce.php, xmlrpc.php, wp-cron.php, wp-admin\/upgrade.php","exclude_theme_access":"","exclude_plugins_access":"","new_theme_path":"","new_style_name":"","style_expiry_days":"","auto_config_plugins":"","new_include_path":"","new_plugin_path":"","rename_plugins":"","new_upload_path":"","replace_comments_post":"","replace_admin_ajax":"","new_content_path":"","separator2":"","new_login_path":"","new_admin_path":"","separator3":"","api_disable":"0","api_base":"","api_query":"rest_route","author_enable":"1","author_base":"\/author","author_query":"author","author_without_base":"","feed_enable":"1","feed_base":"\/feed","feed_query":"feed","post_enable":"1","post_base":"\/%postname%\/","post_query":"p","page_enable":"1","page_base":"\/","page_query":"page_id","paginate_enable":"1","paginate_base":"\/page","paginate_query":"paged","category_enable":"1","category_base":"","category_query":"cat","tag_enable":"1","tag_base":"","tag_query":"tag","search_enable":"1","search_base":"\/search","search_query":"s","nice_search_redirect":"","disable_archive":"","disable_other_wp":"","remove_html_comments":"","minify_new_style":"","replace_javascript_path":"1","remove_feed_meta":"on","remove_other_meta":"on","remove_default_description":"on","remove_ver_scripts":"","remove_body_class":"","remove_menu_class":"","clean_post_class":"","clean_new_style":"","replace_in_ajax":"","replace_wpnonce":"","disable_xml_rpc":"","internal_css":"","internal_js":"","enable_ids":"on","ids_mode":"0","ids_email":"admin@example.com","ids_level":"0","ids_admin_include":"","ids_cookie":"","logger_link":"","log_ids_min":"5","block_ids_min":"30","email_ids_min":"30","exception_fields":"REQUEST.comment\r\nPOST.comment\r\nREQUEST.permalink_structure\r\nPOST.permalink_structure\r\nREQUEST.selection\r\nPOST.selection\r\nREQUEST.content\r\nPOST.content\r\nREQUEST.__utmz\r\nCOOKIE.__utmz\r\nREQUEST.s_pers\r\nCOOKIE.s_pers\r\nREQUEST.user_pass\r\nPOST.user_pass\r\nREQUEST.pass1\r\nPOST.pass1\r\nREQUEST.pass2\r\nPOST.pass2\r\nREQUEST.password\r\nPOST.password\r\nPOST.hide_my_wp.%\r\nREQUEST.hide_my_wp.%\r\nPOST.%import%\r\nREQUEST.%import%\r\nREQUEST.newcontent\r\nPOST.newcontent\r\nREQUEST.remember_%","ids_html_fields":"","separator4":"","avoid_wp_admin_access":"","allowed_ips_wp_admin_access":"203.0.113.10","trust_network":"on","help_trust_network":"","enable_smwp_server":"","blocked_ips":"","blocked_ip_message":"You are blocked. Please contact site administrator if you think there is a problem. ","blocked_countries":"","allowed_countries":"","replace1":"","replace2":"","new_intrusions_count":0}Provide above report to support team to get better and faster service.
Quick Fix Guide
▸ Video Tutorials
- Make sure you have a writable htaccess file (if you use Apache) or configured your web server manually (if you use Nginx, IIS or enabled multi-site). Follow installation guide for details.
- Disable features which have an asterisk(*) in their names or use a more compatible settings scheme.
- See Frequently Asked Questions for common issues.
- To remove remained WP footprints use Replace Tools
- Use our dedicted Support Forum for other issues
Undo Settings
Click above to restore previous saved settings!
Clean Uninstall
Hiding
Hide Login Page
Login Query
Login parameter for protected login address (default: hide_my_wp) e.g. wp-login.php?hide_my_wp=ADMIN_KEY
Admin Login Key
Current Login url: /wp-login.php?hide_my_wp=1234 (Save changes to update) Want something like "/login"? Change New Login Path (Permalinks tab)
Hide Admin
Spy Notify
Anti-Spam
Full Hide
Hide Online Detectors
Hide Other Files
Directory List
Canonical Redirect
Hide Admin Bar
404 Page Template
Custom 404 Page
We use this as 404 page.
Trusted User Roles
Choose trusted user roles. (Administrator are trusted by default)
Replace Mode
How should we replace old URLs? (Use Full mode with cache)
Customized htaccess
CDN Path
Enter your main CDN address
Email sender nameWill be deprecated in next release.
e.g. John Smith
Email sender addressWill be deprecated in next release.
e.g. info@example.com
Hide PHP Files
Exclude Files
Except these PHP files (or folders). Separate with ,
Exclude Theme
Exclude Plugins
Permalinks
New theme path
e.g. "/template"
New style name
e.g. "main.css" (Require New theme name)
Style Expiry Header
(in days) for browser caching
Auto Configuration
New wp-includes path
e.g. "/lib"
New plugin path
e.g. "/modules"
Rename Plugins
New upload path
e.g. "/file". If your theme or your image plugins uses TimThumb (check source code) read here.
Post Comment
Change "wp_comments_post.php" URL (e.g. "/user_submit" or "/folder/user_submit.php").
AJAX URL
Change wp-admin/admin_ajax.php URL (e.g. "/ajax" or "ajax.php").
New wp-content path
e.g. "/inc" You usually do not need to use it. Only useful for some kinds of plugins (cache, gallery)
Change Login URL
Change wp-login.php e.g. login
New wp-admin Path*
Change "https://uknew.co/wp-admin" (e.g. panel, cp). REQUIRE to update wp-config.php manually
API
API Base
Change "/wp-json/" (e.g. rest, api). NOTE: Please flush the rewrite rule.
API Query
Change /?rest_route=1 (e.g. rest_api).
Author
Author Base
Change "/author/username" (e.g. user, profile, members/editrs/).
Author Query
Change /?author=1 and /?author_name=username (e.g. u, user, member).
Author without base
Feeds
Feed Base
Change /feed (e.g. xml, rss, index.xml).
Feed Query
Change /?feed=rss2 (e.g. xml, rss, sitefeed).
Post
Post Permalink
Post Query
Change /?p=1 (e.g. article_id, news_id or pid).
Page
Page Base
Change /sample-page to /X/sample-page (e.g. pages, static).
Page Query
Change /?page_id=1 or /?page_name=about (e.g. pages).
Paginate
Paginate Base
Change /page/2 (e.g. pages, go).
Paginate Query
Change /?paged=2.
Category
Category Base
Category Query
Change /?cat=1 or /?category_name=uncategorized (e.g. topic).
Tag
Tag Base
Tag Query
Change /?tag=tag1 (e.g. keyword, find).
Search
Search Base
Change /search/keyword (e.g. find, s, dl).
Search Query
Change /?s=keyword (e.g. find, s, dl).
Search base redirect
Disable Archive
Disable Other WP
Protection
Enable IDS
IDS Mode
Alert Email
Send IDS email alerts to this email
Enable IDS For
Monitor potential dangerous requests.
Track Admin
Monitor Cookies
Logs
Log Threshold
Minimium total impact to log the request. 0 to disable logging.
Block Threshold
Minimium total impact to block request with a 404 page. 0 to disable blocking *
Notify Threshold
Minimium total impact to notify you about the request by an email. 0 to disable notifing.
Exception fields
Define fields that will be excluded from PHPIDS. One field per line. e.g. POST.my_field
wildcard example: %.hide_my_wp.% You may need to add each field several times (GET.my_field and REQUEST.my_field)
HTML fields
Define fields that contain HTML and need preparation before hitting the PHPIDS rules. One field per line. Note: Fields must contain valid HTML
Show wp-admin only allowed IP's
Allowed IP's for wp-admin
Separate with , e.g. 203.0.113.3, 203.0.113.*, 198.51.100.1/24
Enable trust network
Participate in Trust Network
Scan My WP Whitelist
Blocked IPs
Separate with , e.g. 203.0.113.3, 203.0.113.*, 198.51.100.1/24 Do not enter your own IP for testing purposes!
Blocked Message
This message will be shown to blocked IPs. HTML is allowed.
Blocked Countries Code
Visitors from these countries will be blocked. Use ISO-2 code list. Separate with , e.g. US, UK, CA. Best result for less than ~100K visits/day
Allowed Countries Code
Only visitors from these countries will be allowed. Use ISO-2 code list. Separate with , e.g. US, UK, CAThis option will override `Blocked Countries Code` Leave blank for allow all countries.
Cleanup
Minify HTML
Remove comments and whitespaces from HTML (Use with cache).
Minify style
Remove theme info and other comments from stylesheet. (Require new style name)(Use with cache!).
Replace \/ URLs
Choose if you see Javascript URLs (e.g. \/wp-content\/themes)
Feed Meta
Other Meta
Default Tagline
Remove Version
Body Classes
Menu Classes
Post Classes
Clean up other
Replace in AJAX
Change Nonce
Disable XML RPC
Internal CSS
Useful to paste internal CSS code (Require New Theme Path)
Internal JS
Useful to paste internal JS code (Require New Theme Path)
Replace
Replace in HTML
Do not use this to change URLs
Use [bslash] for '\'
Base on OSes multiple lines queries may work or not so please check.'
Use [bslash] for '\'
Base on OSes multiple lines queries may work or not so please check.'
Replace URLs
Use this only to change URLs.
Relative path base on WP directory. e.g. wp-content/plugins/woocommerce/assets/css/woocommerce.css Replace ec.css
You can also replace some kind of custom paths
Add '/' at the end of the first path to change all files at the folder.
Relative path base on WP directory. e.g. wp-content/plugins/woocommerce/assets/css/woocommerce.css Replace ec.css
You can also replace some kind of custom paths
Add '/' at the end of the first path to change all files at the folder.
Ekran niezalogowanego odwiedzającego — żądania z zapisanymi ustawieniami
302 → 200Przekierowanie do /wp-login.php
W
Nazwa użytkownika lub adres email
Hasło
Zapamiętaj mnieLogowanie
Przechodzi do ekranu logowania, tak jak w zwykłym WordPressie.
302 → 200
W
Nazwa użytkownika lub adres email
Hasło
Zapamiętaj mnieLogowanie
Opcja Hide Admin jest wyłączona, więc /wp-admin/ kieruje do ukrytego adresu logowania. Efekt zmiany adresu znika.
404
Strona nie została znaleziona
Strona 404 motywu
Dla niezalogowanych odwiedzających /wp-admin/ wygląda jak strona, która nie istnieje.
200
W
Nazwa użytkownika lub adres email
Hasło
Zapamiętaj mnieLogowanie
Ekran logowania otwiera się pod domyślnym adresem logowania.
404
Strona nie została znaleziona
Strona 404 motywu
Opcja Hide Login Page jest włączona, więc domyślny adres logowania zwraca 404.
200
W
Nazwa użytkownika lub adres email
Hasło
Zapamiętaj mnieLogowanie
Ekran logowania otwiera się pod zmienionym adresem logowania.
404
Strona nie została znaleziona
Strona 404 motywu
Pole Change Login URL jest puste, więc ten adres to strona, która nie istnieje.
200
W
Nazwa użytkownika lub adres email
Hasło
Zapamiętaj mnieLogowanie
Adres zapasowy z Login Query i Admin Login Key otwiera ekran logowania przy każdym ustawieniu. Zmień wartość klucza z domyślnej 1234 na inną.
200
faultCode 403
faultString Błędna nazwa lub hasło.
faultString Błędna nazwa lub hasło.
Gdy XML-RPC jest włączony, odpowiada, czy nazwa użytkownika i hasło są poprawne, bez przechodzenia przez ekran logowania. Zmiana adresu logowania tego nie zmienia.
405
faultCode 405
faultString Usługa XML-RPC jest wyłączona.
faultString Usługa XML-RPC jest wyłączona.
Gdy włączysz Disable XML RPC, żądania wymagające logowania są odrzucane.
Nawet z pustym polem Purchase Code na karcie [Start] omawiane w tym artykule ustawienia – zmiana adresu logowania, ukrywanie i wyłączenie XML-RPC – zostały zapisane i działały. Hide My WP to płatna wtyczka sprzedawana w CodeCanyon.
2️⃣ Zmiana adresu logowania
Gdy włączysz Hide Login Page na karcie [Hiding], domyślny [wp-login.php] zwraca 404, a pola Login Query i Admin Login Key rozwijają się zaraz po zaznaczeniu opcji.
Gdy na karcie [Permalinks] wpiszesz w Change Login URL nowy adres, np. newlogin, i zapiszesz, ekran logowania otworzy się pod tym adresem. Jeśli zostawisz nowy adres pusty, zalogujesz się tylko przez adres zapasowy z dołączonymi Login Query i Admin Login Key, np. [wp-login.php?hide_my_wp=1234]; ponieważ ten adres zapasowy działa przy każdym ustawieniu, zmień wartość klucza z domyślnej 1234 na inną.
3️⃣ Ustawienia Hide Login Page & Hide Admin
Hide Login Page ukrywa ekran logowania, a Hide Admin – adres panelu administracyjnego, /wp-admin/.
Jeśli ukryjesz tylko ekran logowania, WordPress przekieruje niezalogowanego odwiedzającego, który otworzy /wp-admin/, na zmieniony adres logowania, więc nowy adres wyjdzie na jaw. To tak, jakby zmienić kod do drzwi wejściowych, a portier podawał nowy kod każdemu, kto zapyta.
🧭 Jak ukryty adres logowania wychodzi na jaw
Diagram objaśniający🔐 Hide Login Page
↓
Otwarte po wylogowaniu
/wp-login.phpDomyślny adres logowania
Ekran logowaniaNieistniejąca strona/newloginZmieniony adres logowania
Ekran logowania🛡️ Hide Admin
↓
Otwarte po wylogowaniu
/wp-admin/Adres panelu administracyjnego
Przejście do ekranu logowaniaPrzejście na nowy adres logowaniaNieistniejąca stronaGdy oba ustawienia są wyłączone, działa jak zwykły WordPress: /wp-admin/ prowadzi do ekranu logowania (302), a /wp-login.php też otwiera ekran logowania.
Gdy włączona jest tylko opcja Hide Admin, /wp-admin/ staje się nieistniejącą stroną (404), ale domyślny adres logowania /wp-login.php nadal się otwiera.
Gdy ukryjesz tylko ekran logowania, /wp-login.php staje się nieistniejącą stroną (404), ale odwiedzający, który otworzy /wp-admin/, trafia na zmieniony adres logowania (302) i poznaje nowy adres.
Gdy oba ustawienia są włączone, /wp-admin/ i /wp-login.php stają się nieistniejącymi stronami (404), a ekran logowania otwiera tylko administrator, który zna zmieniony adres.
Gdy włączysz także Hide Admin, /wp-admin/ wygląda dla niezalogowanych odwiedzających jak nieistniejąca strona (404) i nie da się poznać nowego adresu logowania.
4️⃣ Wyłączanie XML-RPC
Nawet z ukrytym adresem logowania [xmlrpc.php] pozostaje kolejnym wejściem, które przyjmuje nazwę użytkownika i hasło.
Gdy włączysz Disable XML RPC na karcie [Cleanup], żądania wymagające logowania są odrzucane z kodem 405 i komunikatem [Usługa XML-RPC jest wyłączona.], ale sam plik [xmlrpc.php] nadal odpowiada. Aby żądania w ogóle nie docierały do PHP, zablokuj go w konfiguracji serwera.
Czasem ustawienie pozostaje włączone nawet po odznaczeniu Disable XML RPC i zapisaniu, dlatego po zapisaniu sprawdź je jeszcze raz na prawdziwej odpowiedzi.
5️⃣ Reguły .htaccess, które zostają po dezaktywacji Hide My WP
Po kliknięciu [Save Settings] Hide My WP dodaje w bloku WordPress pliku .htaccess regułę dla nowego adresu logowania.
# .htaccess — wiersz dodany po zapisaniu Change Login URL jako newlogin
RewriteRule ^newlogin /wp-login.php?zV_hide_my_wp=1234 [QSA,L]Po dezaktywacji wtyczki ten wiersz został w .htaccess, a ekran logowania nadal otwierał się pod zmienionym adresem. Gdy usuwasz wtyczkę, skasuj ten wiersz z .htaccess i zapisz plik.
ℹ️ Informacja o linkach partnerskich
Treści tej witryny zawierają linki partnerskie. Jeśli odwiedzający kupi produkt lub usługę przez taki link, witryna otrzymuje od sprzedawcy prowizję. Kwota płacona przy tym przez kupującego (podczas promocji spada↓) nie wzrasta. Podane ceny, rabaty i dostępność odnoszą się do chwili pisania i mogą różnić się od stanu faktycznego, dlatego przed zakupem sprawdź je u sprzedawcy. Produkty wybieramy i oceniamy według własnych kryteriów, a prowizja nie wpływa ani na kolejność prezentacji, ani na treść ocen.