v1.1

arkhost-security-pack/arkhost-security-pack.php

@@ -2,7 +2,7 @@
 /**
  * Plugin Name: ArkHost Security Pack
  * Description: A free, lightweight security plugin with zero upsells. Login protection, IP blocking, hardening, and activity logging.
- * Version: 1.0
+ * Version: 1.1
  * Requires at least: 5.0
  * Requires PHP: 7.4
  * Author: ArkHost
@@ -21,7 +21,7 @@ if ( ! defined( 'ABSPATH' ) ) {
 }
 
 // Plugin constants.
-define( 'ARKSP_VERSION', '1.0' );
+define( 'ARKSP_VERSION', '1.1' );
 define( 'ARKSP_PLUGIN_FILE', __FILE__ );
 define( 'ARKSP_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'ARKSP_PLUGIN_URL', plugin_dir_url( __FILE__ ) );

arkhost-security-pack/includes/class-arksp-login-protection.php

@@ -29,6 +29,13 @@ class ARKSP_Login_Protection {
 	 */
 	private $cookie_name = 'arksp_login_access';
 
+	/**
+	 * Whether the current request came through the custom login slug.
+	 *
+	 * @var bool
+	 */
+	private $is_custom_slug_request = false;
+
 	/**
 	 * Constructor.
 	 */
@@ -71,14 +78,17 @@ class ARKSP_Login_Protection {
 		if ( ARKSP_Plugin::get_setting( 'login_rename_enabled', false ) ) {
 			$this->custom_login_slug = ARKSP_Plugin::get_setting( 'login_custom_url', '' );
 			if ( ! empty( $this->custom_login_slug ) ) {
-				// Handle custom login slug immediately (constructor runs during plugins_loaded).
-				$this->handle_custom_login_slug_early();
-
-				// These hooks can run on init.
+				// Register URL filters BEFORE handle_custom_login_slug_early() because
+				// it loads wp-login.php and exits. Without these filters active, the
+				// login form action URL points to wp-login.php instead of the custom
+				// slug, causing the form POST to be blocked by should_block_direct_wp_login().
 				add_action( 'init', array( $this, 'restrict_wp_login' ), 1 );
 				add_filter( 'site_url', array( $this, 'filter_login_url' ), 10, 4 );
 				add_filter( 'wp_redirect', array( $this, 'filter_redirect_url' ), 10, 2 );
 				add_filter( 'login_url', array( $this, 'filter_login_url_direct' ), 10, 3 );
+
+				// Handle custom login slug immediately (constructor runs during plugins_loaded).
+				$this->handle_custom_login_slug_early();
 			}
 		}
 
@@ -117,6 +127,11 @@ class ARKSP_Login_Protection {
 	 * @return bool True if access should be blocked.
 	 */
 	private function should_block_direct_wp_login() {
+		// If wp-login.php was loaded via the custom slug handler, never block.
+		if ( $this->is_custom_slug_request ) {
+			return false;
+		}
+
 		// Only applies when custom login URL is enabled.
 		if ( ! ARKSP_Plugin::get_setting( 'login_rename_enabled', false ) ) {
 			return false;
@@ -740,6 +755,10 @@ class ARKSP_Login_Protection {
 		// Also set it in the superglobal for immediate availability.
 		$_COOKIE[ $this->cookie_name ] = $cookie_value;
 
+		// Flag that this request came through the custom slug so login_init
+		// won't block it in should_block_direct_wp_login().
+		$this->is_custom_slug_request = true;
+
 		// Directly load the login page (like WPS Hide Login does).
 		require_once ABSPATH . 'wp-login.php';
 		exit;
@@ -854,6 +873,11 @@ class ARKSP_Login_Protection {
 	 * Block unless user has the access cookie from custom login slug.
 	 */
 	public function restrict_wp_login() {
+		// If wp-login.php was loaded via the custom slug handler, never block.
+		if ( $this->is_custom_slug_request ) {
+			return;
+		}
+
 		// Check if we're on wp-login.php using the reliable $pagenow global.
 		if ( ! isset( $GLOBALS['pagenow'] ) || 'wp-login.php' !== $GLOBALS['pagenow'] ) {
 			return;

arkhost-security-pack/readme.txt

@@ -4,7 +4,7 @@ Tags: security, firewall, login, 2fa, malware
 Requires at least: 5.0
 Tested up to: 6.9
 Requires PHP: 7.4
-Stable tag: 1.0
+Stable tag: 1.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -145,10 +145,17 @@ Possible but likely to cause conflicts. We recommend using one security plugin a
 
 == Changelog ==
 
+= 1.1 =
+* Fixed: Custom login URL form submission redirecting to 404 page
+* Fixed: URL rewrite filters not being registered before login page render
+
 = 1.0 =
 * Initial release
 
 == Upgrade Notice ==
 
+= 1.1 =
+Fixes custom login URL breaking on form submission (404 redirect).
+
 = 1.0 =
 Initial release.