5

I have some small Drupal 7 sites that don't require me to log in all the times, and there are no users. I would like to change the user login path to something else to deter bots targeting Drupal installations on the /user path.
How can I achieve this?

I can add a CAPTCHA, but I want to change the path too.

  • Why So Serious ? Use some htaccess with IP matching to keep everyone accessing the /user path away. Simplest method I can think of. – AyeshK May 30 '13 at 2:47
  • Perhaps easier to add reCaptcha or similar to the relevant forms, though IP address restrictions on the relevant paths would also work. – David Thomas May 30 '13 at 2:51
  • you can do it using create separate page by using penal then define login form on this my page when user try to login redirect it on that page hopefully its helps you – Adeel Nawaz Sep 22 '15 at 11:46
  • If you go to 'admin/config/search/path' you can set alias for 'user/login'. – arpitr Sep 22 '15 at 13:15
4

See the Rename Admin Paths module. The purpose of this module is to secure drupal backend by overriding admin path. You can change user/login to something like member/login. I would also suggest adding a redirect in your htaccess to the standard user/login user/register. This way Drupal doesn't also have to serve up the 404 when a bot tries to access those pages. Huge performance savings.

EDIT: Thinking about this further, you don't need an extra module at all. Just add an alias at /admin/config/search/path/add for user/login, user/register etc, then just add redirects in your htaccess for the old aliases.

  • Thats the thing I want them to generate a 404 error if they goto /user path. What worries me is if this would cause issues for other modules that reference /user. – Patoshi パトシ Jan 29 '13 at 23:20
  • 2
    Why generate a 404 which on an 'average' site with an 'average' module load, you can be looking at 60-100MB of memory being consumed on your server to deliver a 404. If you are the only one accessing user/login, then screw everyone else and let an htaccess redirect send them off to a black hole or infinite loop. Something like one of the methods suggested at stackoverflow.com/questions/10707924/… – Nigel Waters Jan 29 '13 at 23:46
2

1.You can render login form on any site or in any block like this:

$form = drupal_get_form("user_login"); 
$form = drupal_render($elements);
print $form;

You then just need to set proper alias for this page.

2.hook_preprocess_page(&$variables).

$current_path = current_path();
 $current_alias = drupal_get_path_alias($current_path);
 if($current_alias == 'user'){
   drupal_goto('my-url');
 }
  • read carefully, the question is not about to redirect to another url. Question is about to change url path from user to my-url . – WaQaR Ali Sep 22 '15 at 12:01
  • look at the db table url_alias. user is a source not an alias. So if I am understanding it correctly, you can not change this so easily – Paul Bönisch Sep 22 '15 at 12:08
  • Thanks, I'm going to try. I had some problem in the past using drupal_goto(), any other way to get the same using other function? – chefnelone Sep 22 '15 at 13:12
  • I need to remove the "user" url access. – chefnelone Sep 22 '15 at 13:13
  • you mean if somebody calls your_domain.com/user, access denied should occur? – Paul Bönisch Sep 22 '15 at 13:14
1

I have a quick and easy solution I use for this scenario with no modules required. Use htaccess to redirect any visitors to user or user/login to a 404 (or I redirect them to a hidden page that logs their IP address so I can track how often they visit). Then when you want to login just user a bogus parameter in the url like /user/login/12345 This will send 99% of these spam bots off into space :)

1

You have a couple approaches to change the "user" Drupal path to "my-url":

First, you imitate the way Drupal defines the "user" path on user core module. In that way your "my-url" page will have same behavior than the original one.

Then, to complete the work you will need to redirect all "user" requests to your "my-url" path. To do that you can use custom code by using the hook_menu_site_status_alter() hook or you could use the redirect module.

Here's a quick implementation with custom code:

/**
 * Implements hook_menu().
 */
function yourmodule_menu() {

  // Registration and login pages.
  $items['my-url'] = array(
    'title' => 'User account',
    'title callback' => 'user_menu_title',
    'page callback' => 'user_page',
    'access callback' => TRUE,
    'file' => 'user.pages.inc',
    'weight' => -10,
    'menu_name' => 'user-menu',
    'file path' => drupal_get_path('module', 'user'),
  );

  return $items;
}

/**
 * Implements hook_menu_site_status_alter().
 */
function yourmodule_menu_site_status_alter(&$menu_site_status, $path) {
  if ($path == 'user') {
    drupal_goto('my-url');
  }
}

Note: the redirect module is not integrated with features module. If you want to propagate automatically this change to all your environments I suggest you to use custom code.

  • Will this code return a "access denied" for the "user/" url? I need this. – chefnelone Sep 24 '15 at 10:14
  • No, this code will redirect user from "user/" to "my-url". But I could provide a code snippet to return access denied – gerzenstl Sep 24 '15 at 12:14
0

Example:

/**
 * Implements hook_url_outbound_alter().
 */
function custom_module_url_outbound_alter(&$path, &$options, $original_path) {
  // Alter paths for login and sign-up pages.
  if ($path === 'user/login' || $path === 'user/sign-up') {
    $path = 'omfg';
  }
}

protected by Community Jan 6 '17 at 10:34

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.