WordPress security: Hide login error messages

WordPress security: Hide login error messages

Theses days, there’s a lot of talk about WordPress security due to recent issues. Is your blog secure? Here is a quick tip that you can easily implement to prevent displaying useful message to potential blog hackers.

When you (or someone) try to login on your blog, but fails, WordPress display a message to let you know what happened. Sure, it may be useful to you, but it is for sure also useful to potential blog hackers.

To remove theses messages, simply open your functions.php file and paste the following code:

add_filter('login_errors',create_function('$a', "return null;"));

That's all. No more error messages!

Thanks to Ryan Imel for this great tip!

24 Responses

Joen

Sep 14 2009 10:58

This is a good tip.

It should be pointed out, however, that this tip alone will do nothing to quell that worm that’s going ’round. Only upgrading to 2.8.4 will make your blog safe from that.

Akbar

Sep 15 2009 03:37

oh… so poor…

Jean-Baptiste Jung

Sep 15 2009 06:21

@Akbar : Your comment too is also a great example of “poor” thing.

Compute Live

Sep 15 2009 15:41

Simple and useful tip…Its really important to safeguard our blog in every possible way..

RWH

Sep 15 2009 21:33

Short, simple and very useful tip. I would definitely try implementing it on my blog and see how it goes..

Akshay

Sep 15 2009 21:37

Excellent one!!!

Web 2.0 Tools

Sep 16 2009 22:52

I never thought it could be that easy… Thanks for the great tip

Albert

Sep 18 2009 09:54

Thanks for the useful security tips. We have to be aware of wordpress Hackers…!

Juarez P. A. Filho

Sep 21 2009 10:01

I don’t know… Remove messages… I think in web sites and apps FEEDBACK is the best choice, because we need inform users what’s going on, so rename WordPress error messages is a better way to send nice feedback to users and put away malicious users.
Messages like “Please, check your username and password because they don’t match” or something like that, but I like to know that exist a easy way to change it.

Vladimir

Sep 21 2009 17:10

I agree with Juarez. Do not show any reaction on the user’s error is not a good practice. But thank you for the help in finding a way to hide the unique message which can help to attacker identify some vulnerability. I talk about LoginLockDown login ‘your IP is blocked’ message. I can change it with the help of this recipy now. I put this code

function login_error_mess() {
return ‘ERROR: Invalid username or password.’;
}
// Remove LoginLockDown’s message about IP blocking
add_filter(‘login_errors’, ‘login_error_mess’);

in my theme function.php to have only one message for all kinds of login errors. Also I added this line to the functions.php

// Remove Login LockDown advertisement from Login Dialog
remove_action(‘login_form’, ‘ll_credit_link’);

in order to remove Login LockDown plugin identification/advertisement from Login dialog box.

Paul Olyslager

Sep 22 2009 15:29

As already pointed out, people need feedback if something went wrong/right… But a great tip none the less, makes me think about all the other obvious messages which maybe can be used for breaking in…
Is this tip still a working solution, even if you upgraded to the 2.8.4 version?