wp-login.php is the most-requested path on the internet. There is no
password here to guess, so this is not about brute force — it is that a
wallet login screen answering that path tells every scanner that goes
past exactly what is running, and serves a few hundred bots a day a page
they cannot use.
Setting a login address moves the screen and makes wp-login.php answer
404 through the theme's own template. A 404 and not a redirect: a
redirect would hand the new address to the first scanner that asked for
the old one. Everything that builds a login URL follows it, because they
all go through site_url() or network_site_url() with a wp-login.php
path, and there is a wp_redirect backstop for code that builds the URL
by hand.
Refusing wp-login.php has to happen at wp_loaded and has to end the
request there. The web server sends that path to the file directly
rather than through index.php, so by the time anything of ours runs we
are already inside its require of wp-load.php — rewriting $pagenow
changes what WordPress thinks the request is, but it does not stop the
script that is already running.
What this does not do is rename wp-admin. WordPress has no supported way
to, and faking it with a proxy and a filtered admin_url() gets most of
the way before breaking plugins quietly. Breaking plugins is the one
thing this fork promises not to do, so the setting says as much on the
screen rather than implying more than it delivers.
c403a42904