Search mechanisms complaning of access denied error on wp-login.php?action=logout

[rodrigosprimo]

In one of my sites, Google Webmaster is complaining of access denied errors in thousands of variations of the wp-login.php?action=login URL (with different values for the _wpnonce param).

Those pages are generated by _default_wp_die_handler() and this function doesn't include a noindex robots meta tag in the header. I'm assuming adding such meta tag is the best way to fix this issue. It seems reasonable to me to have noindex on error pages but I'm not sure if this is a good idea since this is not my area of expertise.

I noticed that I'm not the only one having this issue:

​https://wordpress.org/support/topic/google-showing-login-access-denied
​https://productforums.google.com/forum/#!topic/webmasters/XnOFn2CgGyQ
​https://forums.digitalpoint.com/threads/webmaster-url-crawl-error-for-wordpress-wp-login-php-action-logout-_wpnonce.2219262/

Thoughts?

[johnbillion]

In 37210:

Add noindexing to the default wp_die() handler to avoid unnecessary crawl errors in web search engines.

Fixes #34401
Props rodrigosprimo

[jeremyfelt]

wp_no_robots() isn't defined until wp-includes/general-template.php is loaded. It's possible that a rare scenario in wp_not_installed() causes wp_die() to fire before wp_no_robots() is available, causing a fatal error.

We may need to move wp_no_robots() up a bit or just insert the meta tag manually in this case.

[jeremyfelt]

It appears this can happen via dead_db() as well.

[jeremyfelt]

34401.diff​ adds a function_exists check for wp_no_robots(), similar to what we do for language_attributes(). See #3231.

[screamingdev]

Please please please, no final classes. We as devs like to extend WordPress, not being blocked by it :(

[jeremyfelt]

In 37689:

Login: Fire wp_no_robots() in wp_die() only if function exists.

This covers cases where wp_die() is used before general-template.php is loaded.

Fixes #34401.