Change the rules of defending your Redmine against brute-force attacks. This plugin deliberately introduces randomness by responding to failed logins with a HTTP 403 Forbidden or HTTP 401 Unauthorized status. For brute-force bots operating on fixed logic, this unexpected response signals them to stop the attack immediately, creating a simple yet effective security layer.
By default, Redmine confirms a failed login attempt with an HTTP 200 OK status, inadvertently helping brute-force bots. This plugin alters that response by sending an HTTP 403 Forbidden error on failure, breaking the bot’s simple success/failure logic.
This plugin obfuscates your login URL to deter common bots and automated scanners.
Important Note on Security:
This is a preliminary mitigation, not a full security solution. Determined attackers can defeat this measure. Therefore, we strongly advise using it as just one component of a layered defense, which should include:
- Using a Web Application Firewall (WAF).
- Enforcing strong passwords.
- Enabling two-factor authentication (2FA).
- Implementing login attempt limits.
- Regularly updating WordPress and all plugins.
Why It’s Effective
- Bots expect predictability: A
200for a failed attempt and a302for a successful one. - We break the pattern: The plugin responds with a
403or401error on failure. - The result: This unexpected status code confuses the automated script, often causing it to slow down or stop.
Source Code
Download source code from GitHub – https://github.com/Plugins4Own/redmine-login-obfuscator
Contact Our Plugin Development Services
We create plugins for various platforms, including WordPress, Redmine, Mantis, and osTicket. Our solutions enhance functionality, improve usability, and provide custom features tailored to your needs. Whether you need automation, integrations, or unique modifications, we deliver high-quality plugins to optimize your workflow.