I have been looking online for a way to change my wp-login/wp-admin so something else to make the site more secure. There is one plugin called Hide Admin but it doesn't seem to work with the latest version of WP and it now seems unsupoorted.

 

Does anyone else hide and change the admin url? and if so how?

Honestly? Changing the login and admin URLs is more trouble than it's worth.

 

Have you:

 

• Disposed of the "admin" user?
  
• Changed your DB table prefix?
  
• Implemented any sort of protection in your .htaccess?
  
• Verified that you're running all files with the tightest permissions possible?
  

 

If you've already done all that, award yourself a pat on the head. Of course, if you're running on a shared box you're only as secure as the least secure site on it.

Honestly? Changing the login and admin URLs is more trouble than it's worth.

 

Have you:

 

• Disposed of the "admin" user?
  
• Changed your DB table prefix?
  
• Implemented any sort of protection in your .htaccess?
  
• Verified that you're running all files with the tightest permissions possible?
  

 

If you've already done all that, award yourself a pat on the head. Of course, if you're running on a shared box you're only as secure as the least secure site on it.

 

I've done 2 of the 3, haven't really got much in htaccess, what would you recommend in here?

The Perishable Press 5G Firewall is a good start:

 

# 5G BLACKLIST/FIREWALL
# @ http://perishablepress.com/5g-blacklist/

# 5G:[QUERY STRINGS]
<ifModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} (environ|localhost|mosconfig|scanner) [NC,OR]
RewriteCond %{QUERY_STRING} (mod|path|tag)\=\.?/? [NC,OR]
RewriteCond %{QUERY_STRING} boot\.ini  [NC,OR]
RewriteCond %{QUERY_STRING} echo.*kae  [NC,OR]
RewriteCond %{QUERY_STRING} etc/passwd [NC,OR]
RewriteCond %{QUERY_STRING} \=\\%27$   [NC,OR]
RewriteCond %{QUERY_STRING} \=\\\'$    [NC,OR]
RewriteCond %{QUERY_STRING} \.\./      [NC,OR]
RewriteCond %{QUERY_STRING} \?         [NC,OR]
RewriteCond %{QUERY_STRING} \:         [NC,OR]
RewriteCond %{QUERY_STRING} \[         [NC,OR]
RewriteCond %{QUERY_STRING} \]         [NC]
RewriteRule .* - [F]
</ifModule>

# 5G:[uSER AGENTS]
<ifModule mod_setenvif.c>
SetEnvIfNoCase User-Agent ^$ keep_out
SetEnvIfNoCase User-Agent (casper|cmsworldmap|diavol|dotbot)   keep_out
SetEnvIfNoCase User-Agent (flicky|ia_archiver|jakarta|kmccrew) keep_out
SetEnvIfNoCase User-Agent (libwww|planetwork|pycurl|skygrid)   keep_out
SetEnvIfNoCase User-Agent (purebot|comodo|feedfinder|turnit)   keep_out
SetEnvIfNoCase User-Agent (zmeu|nutch|vikspider|binlar|sucker) keep_out
<limit GET POST PUT>
 Order Allow,Deny
 Allow from all
 Deny from env=keep_out
</limit>
</ifModule>

# 5G:[REQUEST STRINGS]
<ifModule mod_alias.c>
RedirectMatch 403 (https?|ftp|php)\://
RedirectMatch 403 /(cgi|https?|ima|ucp)/
RedirectMatch 403 /(Permanent|Better)$
RedirectMatch 403 (\=\\\'|\=\\%27|/\\\'/?|\)\.css\()$
RedirectMatch 403 (\,|//|\)\+|/\,/|\{0\}|\(/\(|\.\.\.|\+\+\+|\||\\\"\\\")
RedirectMatch 403 \.(cgi|asp|aspx|cfg|dll|exe|jsp|mdb|sql|ini|rar)$
RedirectMatch 403 /(contac|fpw|install|pingserver|register)\.php$
RedirectMatch 403 (base64|crossdomain|localhost|wwwroot|e107\_)
RedirectMatch 403 (eval\(|\_vti\_|\(null\)|echo.*kae|config\.xml)
RedirectMatch 403 \.well\-known/host\-meta
RedirectMatch 403 /function\.array\-rand
RedirectMatch 403 \)\;\$\(this\)\.html\(
RedirectMatch 403 proc/self/environ
RedirectMatch 403 msnbot\.htm\)\.\_
RedirectMatch 403 /ref\.outcontrol
RedirectMatch 403 com\_cropimage
RedirectMatch 403 indonesia\.htm
RedirectMatch 403 \{\$itemURL\}
RedirectMatch 403 function\(\)
RedirectMatch 403 labels\.rdf
RedirectMatch 403 /playing.php
RedirectMatch 403 muieblackcat
</ifModule>

# 5G:[bAD IPS]
<limit GET POST PUT>
Order Allow,Deny
Allow from all
# uncomment/edit/repeat next line to block IPs
# Deny from 123.456.789
</limit>

 

Edit: note, that's not exactly the same as the 5G published on the website - I've corrected one rule that was stopping custom menus from working.

Edited June 23, 201214 yr by Renaissance-Design

Ah nice stuff. Appreciated.

I've bugged Chris about his .htaccess before and have been using it since, might have been refined since i last bugged him mind you.

 

For a couple of projects i've had to rename the admin folder and at the end of the day it's really not worth it because you'd be surprised how many plugins fail to follow simple guidelines and you end up spending more time fixing sites when the user gets to them than actually creating the site.