WordPress: how to force a 404 when accessing wp-admin?

Question

I have a custom log-in form on a custom page that handles all logging in/out. The form posts to wp-login.php as required.

<form name="loginform-custom" id="loginform-custom" action="http://localhost/wp-login.php" method="post">

All invalid log-in attempts are handled by this following script in the functions.php file:

/**
 * Redirect user on invalid log-in attempts
 */
function login_failed() {
    wp_redirect( home_url('/access-denied') );
    exit;
}
add_action( 'wp_login_failed', 'login_failed' );

function verify_username_password( $user, $username, $password ) {
    if( $username == "" || $password == "" ) {
        wp_redirect( home_url('/access-denied') );
        exit;
    }
}

And I use the following script in my functions.php file to redirect all non-admins away from wp-admin to a 404 page.

function restrict_admin_with_redirect() {
    if ( ! current_user_can( 'manage_options' ) && ( ! wp_doing_ajax() ) ) {
        wp_redirect( site_url('/404') );
        exit;
    }
}
add_action( 'admin_init', 'restrict_admin_with_redirect', 1 );

However, here is my problem. When non-users (random visitors) try to access wp-admin, they are taken to the access denied page despite the redirect script to 404. For some reason, whenever anybody tries to access wp-admin, the server treats it as a log-in attempt and when they are (of course) denied log-in, they are redirected to the access denied page.

Is there any way I can force a 404 when wp-admin is accessed by a user? Also, I'd like a true 404 and not a redirect to a 404 page (which is not a true 404).

Thoughts?

Is there a way to force anyone (users and non-users) to a 404 when they try to access wp-admin? In the action script above, even if I redirect non-admins to a 404.php page, non-users still get sent to the standard access d

Possible duplicate of How to redirect user to 404 page not found error when non admin try to access wp-admin or wp-login.php — nyedidikeke

crmpicco crmpicco · Accepted Answer · 2017-09-26T11:22:41

Consider this solution from Ragu.cz.

https://wordpress.org/support/topic/make-wp-admin-throw-a-404-page-or-something/#post-8565864

add_action( 'init', 'force_404', 1 );

function force_404() {
    $requested_uri = $_SERVER["REQUEST_URI"];
    do_action('debugger_var_dump', $requested_uri, '$requested_uri', 0, 0);
    do_action('debugger_var_dump', strpos( $requested_uri, '/wp-login.php'), 'FOUND?', 0, 0);

    if (  strpos( $requested_uri, '/wp-login.php') !== false ) {

        do_action('debugger_var_dump', 'REDIRECT', 'REDIRECT', 0, 0);
        // The redirect codebase
        status_header( 404 );
        nocache_headers();
        include( get_query_template( '404' ) );
        die();
    }

    if (  strpos( $requested_uri, '/wp-login.php') !== false || strpos( $requested_uri, '/wp-register.php') !== false ) {

        do_action('debugger_var_dump', 'REDIRECT', 'REDIRECT', 0, 0);
        // The redirect codebase
        status_header( 404 );
        nocache_headers();
        include( get_query_template( '404' ) );
        die();
    }

    if (  strpos( $requested_uri, '/wp-admin') !== false && !is_super_admin() ) {

        do_action('debugger_var_dump', 'REDIRECT', 'REDIRECT', 0, 0);
        // The redirect codebase
        status_header( 404 );
        nocache_headers();
        include( get_query_template( '404' ) );
        die();
    }

    do_action('debugger_var_dump', 'END', 'END', 0, 0);
}

WordPress: how to force a 404 when accessing wp-admin?

1 Answers