v1.1

arkhost-security-pack/includes/class-arksp-login-protection.php

@@ -29,6 +29,13 @@ class ARKSP_Login_Protection {
 	 */
 	private $cookie_name = 'arksp_login_access';
 
+	/**
+	 * Whether the current request came through the custom login slug.
+	 *
+	 * @var bool
+	 */
+	private $is_custom_slug_request = false;
+
 	/**
 	 * Constructor.
 	 */
@@ -71,14 +78,17 @@ class ARKSP_Login_Protection {
 		if ( ARKSP_Plugin::get_setting( 'login_rename_enabled', false ) ) {
 			$this->custom_login_slug = ARKSP_Plugin::get_setting( 'login_custom_url', '' );
 			if ( ! empty( $this->custom_login_slug ) ) {
-				// Handle custom login slug immediately (constructor runs during plugins_loaded).
-				$this->handle_custom_login_slug_early();
-
-				// These hooks can run on init.
+				// Register URL filters BEFORE handle_custom_login_slug_early() because
+				// it loads wp-login.php and exits. Without these filters active, the
+				// login form action URL points to wp-login.php instead of the custom
+				// slug, causing the form POST to be blocked by should_block_direct_wp_login().
 				add_action( 'init', array( $this, 'restrict_wp_login' ), 1 );
 				add_filter( 'site_url', array( $this, 'filter_login_url' ), 10, 4 );
 				add_filter( 'wp_redirect', array( $this, 'filter_redirect_url' ), 10, 2 );
 				add_filter( 'login_url', array( $this, 'filter_login_url_direct' ), 10, 3 );
+
+				// Handle custom login slug immediately (constructor runs during plugins_loaded).
+				$this->handle_custom_login_slug_early();
 			}
 		}
 
@@ -117,6 +127,11 @@ class ARKSP_Login_Protection {
 	 * @return bool True if access should be blocked.
 	 */
 	private function should_block_direct_wp_login() {
+		// If wp-login.php was loaded via the custom slug handler, never block.
+		if ( $this->is_custom_slug_request ) {
+			return false;
+		}
+
 		// Only applies when custom login URL is enabled.
 		if ( ! ARKSP_Plugin::get_setting( 'login_rename_enabled', false ) ) {
 			return false;
@@ -740,6 +755,10 @@ class ARKSP_Login_Protection {
 		// Also set it in the superglobal for immediate availability.
 		$_COOKIE[ $this->cookie_name ] = $cookie_value;
 
+		// Flag that this request came through the custom slug so login_init
+		// won't block it in should_block_direct_wp_login().
+		$this->is_custom_slug_request = true;
+
 		// Directly load the login page (like WPS Hide Login does).
 		require_once ABSPATH . 'wp-login.php';
 		exit;
@@ -854,6 +873,11 @@ class ARKSP_Login_Protection {
 	 * Block unless user has the access cookie from custom login slug.
 	 */
 	public function restrict_wp_login() {
+		// If wp-login.php was loaded via the custom slug handler, never block.
+		if ( $this->is_custom_slug_request ) {
+			return;
+		}
+
 		// Check if we're on wp-login.php using the reliable $pagenow global.
 		if ( ! isset( $GLOBALS['pagenow'] ) || 'wp-login.php' !== $GLOBALS['pagenow'] ) {
 			return;