I've a high visitor website in Drupal 6. For performance reasons I've removed Captcha on all pages.

I don't want anybody to log in and we don't logout.

Can I rename any Drupal file related to login-functionality? I have SSH access and also use drush. When I want to enable login functionality I've move the file back.

  • No you can't do that by renaming a file. You could do it in web server config, by writing a custom module and implementing the relevant hook(s), or hacking at core files. – Clive Jun 24 '20 at 13:34

create a simple custom module, by getting the help of hook_form_FORM_ID_alter to disable login form by the following snippet.

solution A:

function hook_form_user_login_alter(&$form, &$form_state) {
  $form = array();
  // or disable it with the following 
 //$form['#access'] = false;

solution B:

function hook_form_user_login_alter(&$form, &$form_state) {
 $form['#access'] = false;

solution C: disable submit button

function hook_form_user_login_alter(&$form, &$form_state) {
 $form['submit']['#access'] = false;
  • it does not work. But can I call exit(1) instead of unset($form) ? Seems to be working. I hope other portions of the site don't get affected by it – user5858 Jun 24 '20 at 14:19
  • have you tried it @user5858? – Yuseferi Jun 24 '20 at 14:37
  • @user5858 I add a little more. exit(1) is not a safe solution. – Yuseferi Jun 24 '20 at 14:43
  • @user5858 answer has been updated. try it. – Yuseferi Jun 24 '20 at 14:46
  • Sol B seems to be working. If I use Sol C and add a HTML using console <button>Submit</button> then also I'm able to login – user5858 Jun 24 '20 at 17:35

The correct way to avoid users can access the login form is changing the access callback of the route used for the login form and removing the login block from any page.
Altering the form with hook_form_alter() or hook_form_FORM_ID_alter() and setting $form['#access'] to FALSE would just hide the form to the users, who would just see a blank page.
Altering the access callback, users would see an access denied error page if they try to access the login page entering directly the login path in the address bar of the browser (http://example.com/user/login, if clear URLs are enabled, or http://example.com/?q=user/login, in the case clear URLs aren't enabled) which would make clear the login page is not accessible to them. Plus, Drupal wouldn't show any link pointing to the login page, if users don't have access to that route. This means that, if you have a module that adds a link to the login page, that link would not be shown to the users who cannot access the login page.

Since the User module is already using an access callback for user/login, it's sufficient to change it, for example with the following code.

function mymodule_menu_alter(&$items) {
  if (isset($items['user/login']) {
    $items['user/login']['access callback'] = FALSE;

Setting the access callback to FALSE makes user/login not accessible from any user.

I would not use that code, if I am not totally sure users aren't automatically logged off, for example because the session cookie has expired, or because there is a module that logs them off when their session lasted too long.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.