A360 Login Avatar Panel
| 开发者 | igorrubas |
|---|---|
| 更新时间 | 2026年10月18日 20:50 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Enable or disable the login avatar panel.
- Assign required avatars per user.
- Randomize the avatar order on every login page load.
- Keep normal WordPress login and password handling unchanged.
- Validate the avatar only after successful password authentication.
- Customize the login page background color and background image.
- Track failed and successful login activity.
- Temporarily block IP addresses after repeated failed login attempts.
- Send an administrator email when failed attempts from one IP exceed the configured threshold.
- Optionally block XML-RPC requests when remote publishing or Jetpack is not needed.
- Show a login security dashboard widget and security report in plugin settings.
- Save safelist and denylist entries for IP addresses/ranges and usernames.
- Reset the lockout counter from the security settings tab.
安装:
- Upload the
a360-login-avatar-panelfolder to/wp-content/plugins/. - Activate the plugin through the Plugins screen in WordPress.
- Go to Settings > Login Avatar Panel.
- Enable the panel and assign avatars to selected users.
- Save settings.
- Review login activity in the Security tab.
屏幕截图:
常见问题:
Is this real 2FA?
No. It is an additional visual login barrier, not full two-factor authentication. For critical admin accounts, use a dedicated 2FA plugin as well.
Does it change WordPress passwords?
No. WordPress still validates usernames and passwords normally.
Does the plugin reveal whether a login exists?
The avatar is checked only after WordPress has authenticated the user with the correct password, so a wrong avatar does not reveal whether a public username exists.
Can I disable the panel for one user?
Yes. In Settings > Login Avatar Panel, choose "No panel" for that user.
What login data is stored?
The plugin stores event timestamps for successful login activity. For failed login activity, it stores the timestamp, IP address, attempted username, failure reason, and browser user agent. It does not store passwords or submitted passwords.
Can I block XML-RPC?
Yes. Enable "Block XML-RPC requests" in Settings > Login Avatar Panel > Security. Do not enable it if you rely on Jetpack, the WordPress mobile app, or remote publishing through XML-RPC.
更新日志:
- Added a branded banner to the plugin details modal.
- Updated WordPress.org banner artwork.
- Added an optional XML-RPC request blocker.
- Added temporary IP blocking for repeated failed login attempts.
- Added administrator email alerts for repeated failed attempts from one IP address.
- Added detailed failed login records with IP address, attempted username, failure reason, and browser user agent.
- Added failed and successful login tracking.
- Added login security dashboard widget.
- Added Security tab under Settings > Login Avatar Panel.
- Added lockout counter reset.
- Added safelist and denylist settings for IP addresses/ranges and usernames.
- Improved admin settings layout for security controls.
- Added login background color/image settings.
- Initial release.