wpify/disable-login-concatenation

Disables script/style concatenation on the WordPress login page so styles load correctly when load-styles.php and load-scripts.php are blocked by the web server.

Maintainers

Package info

github.com/wpify/disable-login-concatenation

Type:wordpress-muplugin

pkg:composer/wpify/disable-login-concatenation

Statistics

Installs: 4

Dependents: 0

Suggesters: 0

Stars: 0

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

1.0.0 2026-03-31 18:31 UTC

Requires

GPL-2.0-or-later aea3c22f3af3573cc79037680f3a37f62251554c

securitywordpressloginmu-pluginload-stylesload-scripts

This package is auto-updated.

Last update: 2026-03-31 19:34:08 UTC

README

WordPress mu-plugin that fixes broken styles on wp-login.php when load-styles.php and load-scripts.php are blocked by the web server.

Problem

A common security hardening practice is to block access to /wp-admin/load-styles.php and /wp-admin/load-scripts.php for unauthenticated users (e.g. via nginx rules). However, WordPress uses these endpoints to serve concatenated CSS/JS on the login page — so blocking them results in an unstyled login screen.

Solution

This plugin hooks into login_init and disables script/style concatenation. WordPress then outputs individual <link> and <script> tags pointing to static CSS/JS files, which the web server can serve directly without going through the blocked PHP endpoints.

Installation

Copy disable-login-concatenation.php into your mu-plugins/ directory. No configuration needed.

Compatibility

Works with any WordPress version that uses load-styles.php/load-scripts.php for concatenation (WordPress 2.8+).