WordPress mu-plugin that fixes broken styles on wp-login.php when load-styles.php and load-scripts.php are blocked by the web server.
A common security hardening practice is to block access to /wp-admin/load-styles.php and /wp-admin/load-scripts.php for unauthenticated users (e.g. via nginx rules). However, WordPress uses these endpoints to serve concatenated CSS/JS on the login page — so blocking them results in an unstyled login screen.
This plugin hooks into login_init and disables script/style concatenation. WordPress then outputs individual <link> and <script> tags pointing to static CSS/JS files, which the web server can serve directly without going through the blocked PHP endpoints.
Copy disable-login-concatenation.php into your mu-plugins/ directory. No configuration needed.
Works with any WordPress version that uses load-styles.php/load-scripts.php for concatenation (WordPress 2.8+).