我可以重命名wp-admin文件夹吗？

不幸的是,目前尚不可能,也似乎没有意愿将其视为修改,正如您通过 wp-hackers列表上的最新线程和此故障单上的票据 a>.

如果您真的想再次看到它,我建议:

1. 在wp-hackers上呈现您的案例 ,但最好事先警告您的用例好的,而不是"默默无闻的安全性",否则它将被击落.

2. 在具有相同警告的火车票中表达您的观点.

3. 更好的是,将一个补丁上传到可启用跟踪的您所需的功能.

要在工作已经完成时说"不"要困难得多(但是,当然,他们确实比"说"更愿意说"不".)

Unfortunately it's not currently possible nor does there appear to be will to consider it as a modification as you can see by this recent thread on the wp-hackers list and this ticket on trac.

If you'd really like to see this be revisited I'd suggest:

1. Present your case on wp-hackers but be forewarned your use-case better be good and not "security through obscurity" or it will get shot down as above.

2. Present your argument in a trac ticket with the same caveats.

3. Even better, upload a patch to trac that enables your desired functionality. It's much harder to say no when the work has already been done (but of course, they do have a preference for saying "no" a lot more often than they say "yes" so be forewarned.)

否,您不能重命名文件夹.该路径在整个WordPress源代码中的多个位置进行了硬编码.

通过默默无闻的安全性并不是真正的安全性.

No, you cannot rename the folder. The path is hard-coded in multiple locations throughout WordPress' source.

Security through obscurity isn't really security anyway.

WordPress官方支持的一种方法是将WordPress安装文件移到子目录中,同时将站点保留在根目录中,如下所示:

网站网址:http://my-blog.com

管理员URL:http://my-blog.com/7nxnkkugrdzm/wp-admin

虽然这不能让您完全自由地更改管理url,但这意味着您可以前缀使用任何喜欢的前缀.从安全的角度来看,这同样好.它还具有将所有WordPress安装文件移动到用户未知位置的好处,因此它应该成为任何wordpress强化策略的一部分.

从WordPress Codex:为WordPress提供其自己的目录

此外,请注意,尽管此安全方案称为晦涩的URL ,但它与默默无闻的安全性不同. 晦涩的URL 是一种完全有效的安全方案,与密码一样好,而"默默无闻的安全性" 依赖于使用未经验证的秘密程序.

同样需要注意的是,与密码相同:调用自定义文件夹,例如7nxnkkugrdzm,而不是happy-snappy-admin.另外,请确保您的用户知道管理员网址是秘密.

An approach that is officially supported by WordPress is to move the WordPress installation files into a sub-directory, while keeping the site in the root, like so:

Site URL: http://my-blog.com

Admin URL: http://my-blog.com/7nxnkkugrdzm/wp-admin

While this does not give you complete freedom in changing your admin url, it means you can prefix it with anything you like. This is just as good from a security point of view. It also has the benefit of moving all the WordPress installation files into a location unknown to users, so it should be part of any wordpress hardening strategy.

From the WordPress Codex: Giving WordPress Its Own Directory

Also, note that while this security scheme is called Obscure URL, it is not the same thing as security by obscurity. Obscure URL is a perfectly valid security scheme that is just as good as a password, while security by obscurity relies on using secret unproven procedures.

The same caveats apply though as with passwords: Call the custom folder something like 7nxnkkugrdzm, not happy-snappy-admin. Also, make sure your users are aware the admin url is a secret.

实际上,这里有一个很好的教程:

如何从源代码中隐藏WordPress信息 ^镜像

包括如何重命名wp-content,重命名wp-admin以及如何从WordPress中删除Generator标记.

本教程将在源代码中更改明显证据或指示,有效地从您的站点中删除WordPress信息.

它说明了如何更改文件夹名称,wp-admin登录URL,并确保login.php重定向到主站点,以便人们可以直接访问该站点.

There is actually a very good tutorial on this here:

How to Hide WordPress Info from Your Source Code ^mirror

Includes how to rename wp-content, rename wp-admin, and remove the generator tag from WordPress.

This tutorial will change obvious evidence or indications of it in your source-code, effectively removing WordPress info from your site.

It explains how to change the folder name, the wp-admin login url, and make sure that login.php redirects to the main site so that people can go there directly.

如果要阻止订户级用户查看wp-admin目录,可以在其自己的目录中创建登录/注册和配置文件/编辑页面的独立版本.然后,您可以通过htaccess或IP限制保护您的管理员文件夹.(尽管这样做,您应该为admin-ajax文件设置例外,因为某些插件使用它来添加um AJAX功能.)

这种方法为您提供了所需的"模糊性"(实际上并不能做很多,但是通常会使客户和经理感觉更好),并通过限制对管理员的访问来增加一些真正的安全性.另外,说实话,仅显示"/login"的URL比" wp-login.php"好得多.

毋庸置疑,这不会使您的网站防弹.但这是一个不错的基本增强.

If you want to keep subscriber-level users from seeing the wp-admin directory, you can create standalone versions of the login/registration and profile/edit pages in their own directories. Then, you can protect your admin folder via htaccess or IP restriction. (Though if you do this, you should make an exception for the admin-ajax file, as some plugins use it to add, um, AJAX functionality).

This approach gives you the "obscurity" you want (which doesn't really do much, but often makes clients and managers feel better), and also adds some real security by limiting access to the admin. Plus, honestly, a URL that just says "/login" looks a lot nicer than "wp-login.php".

It should go without saying that this doesn't make your site bulletproof. But it's a nice, basic enhancement.

锁定管理控制面板的一种方法是利用.htaccess规则.只需将.htaccess文件添加到wp-admin目录的根目录即可.添加此文件后,只需添加以下规则即可拒绝所有IP地址并仅允许您的IP:

http://wp.tutsplus.com/tutorials/10-steps-to-securing-your-wordpress-installation/

 AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Admin Access Control"
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
whitelist address
allow from <IP ADDRESS HERE>
</LIMIT>
 

One way to lock down the administrative control panel is to utilize .htaccess rules. Just add an .htaccess file to the root of the wp-admin directory. After you add this file, just add the following rule to deny all IP addresses and allow only your IP:

http://wp.tutsplus.com/tutorials/10-steps-to-securing-your-wordpress-installation/

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Admin Access Control"
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
whitelist address
allow from <IP ADDRESS HERE>
</LIMIT>

如果您想重命名wp-admin,目的是为WordPress安装增加额外的安全性,您还可以尝试 根/基岩WordPress样板 .它可以帮助隔离Web根目录,以限制对非Web文件的访问.通过将其放在自己的子目录中(如将wp-content/重命名为app/)以及以下附加功能,它还可以帮助组织/保护整个WordPress核心:

• 使用Composer进行依赖管理
• 使用特定于环境的文件轻松进行WordPress配置
• 使用Dotenv的环境变量
• 用于mu-plugins的自动加载程序(使用常规插件作为mu-plugins)
• 增强的安全性(使用wp-password-bcrypt分隔的Web根目录和安全密码)

您还可以检查其 GitHub存储库以获得更详细的用法:

If you want to rename the wp-admin with the aim of adding additional layer of security to your WordPress installation, you can also try the Roots / Bedrock WordPress Boilerplate. It can help isolate the web root to limit access to non-web files. It can also help in organizing/securing the whole WordPress core by putting it in its own subdirectory like renaming wp-content/ to app/ as well as these additional features:

• Dependency management with Composer
• Easy WordPress configuration with environment specific files
• Environment variables with Dotenv
• Autoloader for mu-plugins (use regular plugins as mu-plugins)
• Enhanced security (separated web root and secure passwords with wp-password-bcrypt)

You can also check their GitHub Repo for a more detailed usage:

看看 http://wordpress.org/extend/plugins/stealth-login/这可能会帮助您.

Take a look at http://wordpress.org/extend/plugins/stealth-login/ this may help you out.

否,无法使用任何短代码或htaccess hack重命名wp-admin文件夹,

过去,我是通过Coda(我使用的编辑器)对标签" wp-admin,wp-content ...etc"执行完整的文件夹搜索来为客户端执行相同操作的,而我删除了" wp- ".

之后,您将能够安装它,但是:
您必须对要安装的插件执行相同的操作, 您必须通过从新版本中清除" wp-"标签来手动更新核心.

在所有方面,我都不建议您做这样的事情, 保持现状,并尝试实施"用户登录/注册/配置文件"页面,以为您的用户/客户提供更好的体验.

来自 Cozmolabs 具有 写一个很好的教程.您可以 稍微编辑一下代码,使其运行 任何WordPress主题.

您还可以从前端添加帖子表单,以便管理员和具有撰写帖子能力的用户可以从前端进行发布.

在这里您可以看到示例和代码 有关如何创建"前端发布"页面的信息. 前端帖子提交

此外,您还可以在此处的插件中查找一些不错的东西.具有更多功能的相同功能.

No it's not possible to rename the wp-admin folder with any short of code or htaccess hack,

In the past i done the same for a client by performing a complete folder search via Coda (the editor i use) for the tag "wp-admin, wp-content...etc" and i remove the "wp-" from the files.

After that you will be able to install it but:
You have to do the same with the plugins you want to install, You have to update the core manually by clearing the "wp-" tag from the new versions.

In all the ways i don't suggest you to do something like this, leave it as is and try to implement a User Login/Register/Profile page to give your users/clients a better experience.

Cristian from Cozmolabs have write a very good tutorial. You can edit the code a bit and make it run in any WordPress theme.

You can also add a Post form from the frontend so the Admin and Users with the Capabilities to write a post can do it from the frontend.

Here you can see an example and code on how to create a Frontend Post page. Front-End Post Submission

Also you can take a look for some nice plugins here that do the same with more functionality.

关于从IFRAME中使用WP-ADMIN的情况是什么?

在wp仪表板中创建一个名为" Admin"的新页面.例如:yourdomain/admin/

您可以使用header.php page.php和/或footer.php进行案例说明,以禁用模板上的内容不需要,使用:

 <?php
if(!is_page('admin')): //if not the admin page.

//wrap code not needed or wanted.

else: ?>

<style type="text/css">
    .responsive-iframe {
    position: relative;
    padding-bottom: 56.25%; /*16:9*/
    height: 0;
    overflow: hidden;

    iframe {
        position: absolute;
        top:0;
        left: 0;
        width: 100%; //or 100vw
        height: 100%; //or 100vh
    }
}   
</style>

<div class="responsive-iframe">
<iframe seamless="seamless" scrolling="yes" src="http://yourdomain/wp-admin/" frameborder="0" allowfullscreen></iframe>
</div>

<?php 
endif;
 

这不是很漂亮,但是至少可以在某种程度上隐藏url中的wp-admin. 另一种方法是在启用掩码URL的情况下使用域转发.

WHAT ABOUT WORKING WP-ADMIN FROM AN IFRAME?

Make a new page in wp dashboard called "Admin". e.g: yourdomain/admin/

You can make a case statement with the header.php page.php and/or footer.php to disable things on the template not needed, using:

<?php
if(!is_page('admin')): //if not the admin page.

//wrap code not needed or wanted.

else: ?>

<style type="text/css">
    .responsive-iframe {
    position: relative;
    padding-bottom: 56.25%; /*16:9*/
    height: 0;
    overflow: hidden;

    iframe {
        position: absolute;
        top:0;
        left: 0;
        width: 100%; //or 100vw
        height: 100%; //or 100vh
    }
}   
</style>

<div class="responsive-iframe">
<iframe seamless="seamless" scrolling="yes" src="http://yourdomain/wp-admin/" frameborder="0" allowfullscreen></iframe>
</div>

<?php 
endif;

This is not pretty, but atleast to some extent you can hide wp-admin from url. Another way is to possibly use domain-forwarding with mask url enabled.