Hi,
When a visitor tries to reset his password he receives a link that reveals the admin directory… even worse, the reset password page is the wordpress panel! This is not secure and it doesn’t look very professional.
Could you please allow the procedure to happen on the visitor side and not on the admin side.
Regards.
Hi,
I realized that the logout procedure also reveals the admin directory :
– logout from the member account page
– logout from the tagdiv header login menu
Both display a logout url that reveals the admin directory as follows :
https://www.SITE.com/ADMIN_DIR/?action=logout&redirect_to=https%3A%2F%2Fwww.SITE.com%2Fmy_account%2F&_wpnonce=e81823cec3
Could you fix this ?
Regards,
Hello,
This is the process of changing the password https://www.screencast.com/t/RBZQSwu1NN. The page to reset it is from the frontend.
Thank you!
Hello Anamaria,
Thank you for the video.
I found the culprit… cerber plugin! I cannot define a customized admin directory anymore… cerber changes the logout and reset urls, reveals the admin directory, and prevents the reset procedure to happen on the frontend. Grrr !
Thanks for your time.
Regards,
Hello,
I’m glad that you find the culprit plugin.
Have a great day!
Hi,
I still have some problem with the reset password procedure…
In the reset password email sent to the user, the reset url reads :
wp-login.php?action=rp&key=xxxxxx&login=XXXX
Once we click on the url, the url is rewritten like this in the browser :
login_page_name/?password_reset&login=XXXX&key=xxxx
For security reasons, I only use the newspaper login page and I block access to wp-login.php, thus if the reset url (even if it is written once clicked) contains wp-login.php, the user will be blocked. He will be redirected to a 404 page.
Could you fix this so that only the rewritten url appears on the reset password email sent to the user ?
So, in the reset password email sent to the user, the url should already be rewritten like this :
login_page_name/?password_reset&login=XXXX&key=xxxx
Then, even if wp-login.php is blocked, the user will be able to complete the reset password procedure.
Looking forward to your reply,
Regards
same problem to activate an account.
Could you have wp-login.php never appear and be replaced by the newspaper login page name ?
Regards,
Hello,
The wp-login.php is the file used for login and use of those hooks.
Thank you!
Hello,
Please re-read my message… this is not what I am saying.
The problem is not that wp-login.php is used… the problem is that the url is not rewritten within the email sent to the member. Even when the url containg wp-login.php is clicked, the member is redirected to :
login_page_name/?password_reset&login=XXXX&key=xxxx
The only thing I ask is that this last url be displayed within the email sent to the member instead of displaying the non-rewritten url. This is the url to which the member is redirected, thus I don’t see where the problem is. Could you ask your developers? This way, blocking the access to wp-login.php (for obvious security matters) works and the member can complete the reset password procedure.
Thanks in advance for your help.
Regards,
Hello,
I have added this request to our list.
Thank you!
Hello,
UPDATE:
Please use this code to change the link for a password reset; please make sure that you have the latest version 12.3 add_filter( 'td_login_password_reset_link', function($password_reset_link) {
return str_replace( 'wp-login.php', 'login_page_name', $password_reset_link );
});
Set the code in functions.php or in the child theme.
Thank you!
