I want to disable login at all on my drupal site, even better also hide the form. If i need login i will enable it from a ssh session and after working disable again.

I will prefer to do this with rewrite rules in .htaccess but i cannot figure out the right rule.

Update (as this seems to be a popular question)

I ended up with .htaccess like this:

 # disable well known Drupal user login endpoints
  RewriteCond %{QUERY_STRING} q=user
  RewriteRule ^/?$ http://%{HTTP_HOST}/? [R=307,L]
  RewriteRule ^user$ http://%{HTTP_HOST}/ [R=307,L]
  RewriteRule ^user/register$ http://%{HTTP_HOST}/ [R=307,L]

  # goto user login with that "secret" URL
  RewriteRule ^op9__P87? /user [NC]
  • 1
    This can be a little complicated, depending on your setup. Where can users login from? Just /user or also is the login form on /admin and other pages?
    – mpdonadio
    Jan 10, 2012 at 15:42
  • It is just /user and /?q=user
    – PeterMmm
    Jan 10, 2012 at 15:48

4 Answers 4


Another way is set the access to false to the login form. Whenever you want to re-enable the login, just comment out the hook.

function mymodule_form_alter(&$form, &$form_state, $form_id) {
  if ($form_id == 'user_login') {
    $form['#access'] = FALSE;

Maybe the Login Disable module will help?

Prevent users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. If a user does find out about the secret key they will still have their user account role checked during authentication .If they do not have the 'bypass disabled login' granted they will be refused access and displayed a customisable "denied" message.

  • That shows the form. It will even better not show the form at all ...
    – PeterMmm
    Jan 10, 2012 at 16:06
  • 1
    drupal.org/node/19855 this shows how to remove the form altogether. Jan 10, 2012 at 16:25

The problem is more of a Apache config issue, rather than a Drupal issue. It also relies on the user login form just being on one page.

# Pass all requests not referring directly to files in the filesystem to
# index.php. Clean URLs are handled in drupal_environment_initialize().

RewriteRule ^user$ - [G,L]
RewriteRule ^q=user$ - [G,L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^ index.php [L]

The q=user rule may require some tweaking, as an artificial URL with q=user in it will end up at the login page.

Note, that there are a few modules that disable user login (such as @Jonathan Rowny suggests), which may be a better option, depending on your scenario.


You can use Disable Login module to disable the login page, and secure it with secret key.

Ref: https://www.drupal.org/project/disable_login

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.