Ace Login Block
| 开发者 | shanerounce |
|---|---|
| 更新时间 | 2026年10月23日 03:53 |
| PHP版本: | 8.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Requires PHP 8.2 or later. Passkeys also need PHP's OpenSSL extension; if it is missing, passkeys switch themselves off and everything else keeps working. Tested on WordPress 6.6, 6.9 and 7.1.
If PHP is older than 8.2 or the bundled libraries cannot load, new logins are refused rather than quietly dropping your second-factor policy. Restore the supported runtime and the complete plugin package through your hosting account. Existing sessions and public pages remain available where WordPress itself supports that runtime.
Ace Login Block allows you to replace the default WordPress login page with a custom page of your choosing, all designed and managed within the block editor. This lets you create a branded login experience for your users while leveraging the flexibility and ease of Gutenberg.
Features include:
- Replace the default WordPress login page with a custom block-based design.
- Full integration with the block editor, giving you complete control over the login page layout.
- Allow the default WordPress login functionality for POST requests to ensure smooth login submissions.
- Customise redirects and add additional fields or branding elements to the login page.
- Preserve core password reset and recovery screens when using a custom login page.
- Role-based redirects and per-role 2FA requirements.
- Passkeys (security keys) for passwordless login and as a second factor.
- Email and authenticator app 2FA, plus backup codes.
- Remembered devices that skip 2FA only (password still required).
- Login lockout after repeated failed attempts. By default, 5 failures within 15 minutes locks the account for 30 minutes. Repeated failures from one IP address, or against a username that does not exist, are limited too.
- A Security tab with a log of failed and blocked logins, filters, one-click unlocking and an optional email when a lockout happens.
- Passkey policy settings: RP ID override, attestation preference, and per-role passwordless control.
- Email codes expire after five minutes and can only be used once.
- Second-factor codes are checked in constant time, with a low hourly attempt limit.
- Authenticator app secrets are encrypted at rest with libsodium.
- The 2FA endpoints do not reveal whether a username exists.
- A passkey used instead of a password has to pass user verification.
- If a factor an account depends on cannot be used, that account is refused with a clear message. The policy is never quietly dropped.
安装:
This section describes how to install the plugin and get it working.
- Upload the plugin files to the
/wp-content/plugins/acemedia-login-blockdirectory, or install the plugin through the WordPress plugin screen directly. - Activate the plugin through the 'Plugins' screen in WordPress.
- Navigate to the "Ace Login Block" settings and select the page to use for your custom login page.
屏幕截图:
常见问题:
How do I customise my login page?
Once the plugin is activated, go to the "Ace Login Block" settings in your WordPress dashboard and select the page you want to use as your custom login page. You can then use the block editor to design the page.
Will WordPress still handle logins?
Yes, WordPress will continue to handle all login submissions via POST requests, ensuring that authentication continues to work normally. Ace Login Block simply replaces the display of the login page with your custom page design for GET requests.
Can I add custom fields to my login page?
Yes, you can add custom blocks, text, images, or any other elements within the block editor to fully customise the layout of your login page.
What happens if I disable the plugin?
If you disable Ace Login Block, WordPress will revert to the default wp-login.php page for login access.
Do remembered devices bypass my password?
No. Remembered devices only skip the 2FA step. Password entry is still required.
What happens after too many failed logins?
By default, 5 failed attempts within 15 minutes locks that account for 30 minutes, and 20 failures from one IP address locks that address. The person sees how long is left, worded the same way for every lock so it does not reveal whether a username exists. All of these numbers can be changed in the settings, and an administrator can unlock an account or address early from the Security tab.
My site is behind Cloudflare. Will everyone share one IP address?
Not if you set Trusted Proxy Header to auto. The visitor's real address is then read from Cloudflare's header, but only when the request genuinely comes from a Cloudflare address, so the header cannot be faked from anywhere else. Private and local addresses are never IP locked.
Can I try it before installing?
Yes. Use the Live Preview button on this page to open a demo members site in WordPress Playground, right in your browser. Sign in as admin / password, or get the password wrong five times to see the lockout (shortened to one minute in the demo).
Do passkeys require HTTPS?
Yes. Passkeys require a secure context (HTTPS or http://localhost).
更新日志:
0.431.0
Release Date: 2026-10-22
- New Security tab: a log of failed and blocked logins with filters and paging, plus one-click unlocking for accounts, IP addresses and unknown usernames.
- Failed logins are now also counted per IP address (IPv6 by /64 network) and per unknown username, so guessing across many accounts is slowed down too. Set the IP limit to 0 to turn IP locking off.
- A correct password from an address the account has signed in from before is not held back by someone else's failures on that account.
- Optional email when a lockout happens, a daily clean-up of old log entries, and a warning when one address is behind most of the failures.
- Trusted Proxy Header setting for sites behind Cloudflare.
- The block login page now tells people when they are locked out and for how long, instead of showing a generic error.
- Uninstalling the plugin now removes the login log, counters and lockout data.
- Passkeys now switch themselves off when PHP's OpenSSL extension is missing, instead of blocking every login. Email codes, authenticator apps, backup codes and lockout keep working, and an admin notice explains what is off.
- An account that needs a passkey for its second factor is refused with a clear message while OpenSSL is missing. No second factor is quietly dropped.
- Sodium is no longer a separate requirement. WordPress provides a fallback, and the plugin loads it if it is not already there.
- A clearer description of the security features.
- Correct PHP requirements and fail closed when authentication dependencies are unavailable.
- Preserve core login actions and other integrations' authentication callbacks.
- Require user verification for passkeys used in place of a password.
- Correct single-use second-factor verification and personal enrolment policy.
- Tested with WordPress 7.1.
- Email 2FA codes now expire after 5 minutes and are single-use (previously never expired).
- Two-factor code verification now uses constant-time comparison (hash_equals).
- Reduced the 2FA attempt rate limit from 1000 to 5 per hour (filterable) to prevent brute-forcing.
- TOTP secrets are now encrypted at rest with libsodium (legacy plaintext secrets remain readable and are upgraded on next save).
- REST 2FA endpoints no longer disclose whether a username exists (prevents user enumeration).
- Sanitised all 2FA code inputs; set an explicit TOTP verification window (±30s).
- Backup-code endpoint no longer returns hash-derived placeholders after generation.
- Renamed internal encryption helpers off the reserved wp_ prefix for WordPress.org compliance.
- Fixed inconsistent 2FA form state handling that could show false authentication popups during successful login.
- Replaced disruptive login alerts with inline status messages across custom login and wp-login flows.
- Improved browser compatibility and secure-context messaging for passkeys.
- Added admin guidance for security key setup, including Flipper Zero/FIDO2 usage notes.
- Improved passkey registration feedback and request handling reliability in user profile screens.
- Fixed the selector for the form submission button.
- Allows users to be redirected based on role-specific settings, even if no custom login page is set.
- Ensures login block functionality is only active when a custom login page override is set.
- Prevents interference with the default WordPress login process when no override page is configured.
- New Feature: Implemented dynamic login redirects based on user roles, allowing specific redirect URLs for each role within the settings.
- Enhancement: Updated ace-login-block.php to handle dynamic redirects, ensuring users are sent to the appropriate page after logging in based on their role.
- Enhancement: Modified package-lock.json and package.json to include new dependencies required for the updated functionality.
- Enhancement: Enhanced src/block.json to support role-based page listings, making it easier to manage page options for each role.
- Enhancement: Updated src/login-block.js to dynamically list available pages per role, improving the settings interface for selecting redirect URLs.
- Important Note: Ensure that roles are properly configured in the WordPress admin to utilize the dynamic redirect feature effectively.
- New Feature: Introduced a custom login block structure to fully control the layout of the form using native block interactions.
- New Feature: Added new blocks for the username and password input fields.
- Enhancement: Dynamic form action URL is now set using localized data from PHP.
- Enhancement: Added nonce handling to the login form for improved security.
- Enhancement: Improved reliability of redirect handling after login.
- Bug Fix: Resolved an issue with form submission not being detected as a POST request.
- Bug Fix: Fixed redirection issues caused by interception from the custom page template.
- Bug Fix: Improved logout handling to ensure users are correctly redirected after logging out.
- Important Note: Ensure the logout link includes the correct action=logout parameter and nonce.
- Bug Fix: Resolved issues with form redirection that affected login functionality in v0.420.
- Enhancement: Added a new option to allow users to show the "Show Password" toggle in the login block.
- Initial Release: First release of the Ace Login Block plugin.
- Key Features:
- Custom Login Page: Replace the default wp-login.php form with a page created in the block editor.
- Post Request Handling: Securely handles login form submissions.
- Seamless Template Loading: Automatically loads the selected custom page template.
- Block Editor Integration: Customise your login page using blocks.
- Debugging: Debug messages included to assist with development.
- Important Note: Known issues with form redirection in this version, recommended to use v0.421 for better performance.