Disable login at all

Question

I want to disable login at all on my drupal site, even better also hide the form. If i need login i will enable it from a ssh session and after working disable again.

I will prefer to do this with rewrite rules in .htaccess but i cannot figure out the right rule.

Update (as this seems to be a popular question)

I ended up with .htaccess like this:

 # disable well known Drupal user login endpoints
  RewriteCond %{QUERY_STRING} q=user
  RewriteRule ^/?$ http://%{HTTP_HOST}/? [R=307,L]
  RewriteRule ^user$ http://%{HTTP_HOST}/ [R=307,L]
  RewriteRule ^user/register$ http://%{HTTP_HOST}/ [R=307,L]

  # goto user login with that "secret" URL
  RewriteRule ^op9__P87? /user [NC]

Answer 1

Another way is set the access to false to the login form. Whenever you want to re-enable the login, just comment out the hook.

function mymodule_form_alter(&$form, &$form_state, $form_id) {
  if ($form_id == 'user_login') {
    $form['#access'] = FALSE;
  }
}

Answer 2

Maybe the Login Disable module will help?

Prevent users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. If a user does find out about the secret key they will still have their user account role checked during authentication .If they do not have the 'bypass disabled login' granted they will be refused access and displayed a customisable "denied" message.

Answer 3

The problem is more of a Apache config issue, rather than a Drupal issue. It also relies on the user login form just being on one page.

# Pass all requests not referring directly to files in the filesystem to
# index.php. Clean URLs are handled in drupal_environment_initialize().

RewriteRule ^user$ - [G,L]
RewriteRule ^q=user$ - [G,L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^ index.php [L]

The q=user rule may require some tweaking, as an artificial URL with q=user in it will end up at the login page.

Note, that there are a few modules that disable user login (such as @Jonathan Rowny suggests), which may be a better option, depending on your scenario.

Answer 4

You can use Disable Login module to disable the login page, and secure it with secret key.

Ref: https://www.drupal.org/project/disable_login