Delete Drupal login capability

Question

In our environment, we make changes to a drupal site that are then replicated to an outside webserver. We do not want people to be able to log into the drupal site from the outside. I want to remove whatever file /user and /admin resolves to but I can't find any information on this. In wordpress, you delete the wp-admin folder. Is there anything like this with Drupal? Turning off the "Allow login" setting will not work for us.

Note- We cannot make any changes that are saved in the database. Changing Drupal settings will not work. There's got to be a login file on the server we can delete.

Answer 1

Just have an htaccess entry that redirects /user and /admin to the front page.

Answer 2

Well you could do a couple of things but you would need to have full access to the admin in the backend and I'm not really sure that if you are saying that the access in the backend is just changing the same database or the content is being pushed by a services type deploy module.

The first thing is hiding the login blocks, which you probably already have done this but here is a link: https://www.drupal.org/node/13777

Next, depending on your setup you will want to either forward the /user (or /user/login if you have user profiles that are on that path) to the home screen. That will make it impossible for a user to login. You could do this with an htaccess rule which is a little out of scope for Drupal Answers or do a redirect using either the redirect module or the rules module. Depending on your setup the rules could match the URL (say if the URL is admin.example.com for the admin install) and forward only the main site /user page to the home page so your users on the admin install can still access the site.

There are probably some more ways to do this, I will add more as I think of them.

Answer 3

There's an alternative:

https://www.drupal.org/project/login_disable

This module requires a "secret" token to access the user login page:

Example: http://example.com/user/?hell0darling-XD

Answer 4

you can remove the login functionality technically, but if you do it, then your administrator could never log onto the site.

you can remove the registration functionality, you simply need to browse to admin/user/settings (for Drupal 6) or admin/config/people/accounts (for Drupal 7) and select the the "Only site administrators can create new user accounts" option.

Reference

• This answer for How to remove user register/login in Drupal

Answer 5

The best way is not to fiddle with the core, or you may end up breaking your site (when applying updates, patches etc). Better way is to implement IP based login (with .htaccess) or use one of the available modules that restricts admin path to selected IP.