Elohim Cyber Guardian

Elohim Cyber Guardian is a WordPress security plugin developed by Elohim Software Solutions Pvt Ltd to help protect your website from unauthorized access, brute-force attacks, and common login-based threats. It provides essential security features with simple configuration and a clear dashboard for monitoring activity. This plugin does not replace a full security solution but adds additional protection layers such as login protection, rate limiting, and monitoring. Features Custom Login URL Use a custom login URL while safely redirecting access from the default login page. Rate Limiting & IP Blocking Limit login attempts and automatically block suspicious IP addresses. Honeypot Protection Detect and stop automated bots without affecting real users. CAPTCHA Support Supports built-in math CAPTCHA and Google reCAPTCHA integration. Attack Logs Track login attempts including IP address, username, and status. Includes CSV export and bulk delete. Email Alerts Receive notifications for suspicious login activity based on a configurable threshold. Auto-Block Automatically block IPs that exceed your configured failed login threshold. Emergency Access Generate secure access tokens if you are locked out. Security Hardening Options Enable additional protections such as:

• Disable XML-RPC
• Hide WordPress version
• Disable file editor
• Enforce HTTPS
• Add security headers

Security Dashboard View your current protection status and activity summary.

1.3 Security and code-quality release addressing the WordPress.org plugin review.

• Removed all PHP session usage. The math CAPTCHA answer and the rate-limit block notice were previously held in $_SESSION, which forced session_start() and made every visitor uncacheable, bypassing server-side page caches such as Nginx FastCGI cache and Varnish. Both now use short-lived transients, so the plugin is fully compatible with full-page caching and managed WordPress hosts.
• The math CAPTCHA challenge is now a single-use, 5-minute token carried in a hidden form field. A token is invalidated on every verification attempt, correct or not, so an answer can never be replayed.
• Restructured the custom login handler so the request nonce is verified before any other value is read from $_POST. Verified values are collected once and passed to the CAPTCHA and login-completion steps as arguments; those methods no longer read superglobals at all.
• Failed logins through the custom login URL now fire WordPress core's wp_login_failed action. Previously they did not, which meant such attempts were invisible to this plugin's own logging and email alerts, and to any third-party brute-force protection the site owner had installed.
• Replaced the $_SERVER['ELOGUARD_INTERNAL_LOGIN'] signalling flag with a private static class property. $_SERVER is request input, not plugin storage.
• Fixed the escaping of the reCAPTCHA site key in inline JavaScript. esc_js() is intended for quoted HTML attributes; the value is now emitted with wp_json_encode(), the correct escaper for a raw script context. The site key in the Google API URL is now passed through rawurlencode().
• eloguard_req_string() now sanitizes as it reads rather than returning a raw value for callers to sanitize separately. A clearly separated eloguard_req_raw_string() is used only for passwords, which must not be sanitized.
• Fixed several inputs that were unslashed or sanitized a line away from where they were read, including the alert email address, REMOTE_ADDR in the log viewer, and the hardening settings AJAX payload.
• Proxy headers (CF-Connecting-IP, X-Forwarded-For, X-Real-IP) are now validated with FILTER_VALIDATE_IP before being trusted, in the emergency-access path as well as the honeypot.
• Added range validation to the reCAPTCHA v3 score threshold, the email alert throttle, the maximum attempt count, and the block duration.
• Split compound nonce conditions in the CAPTCHA and rate-limit settings pages into sequential capability and nonce guards, so the checks cannot be accidentally bypassed by a later edit.
• Replaced a CAPTCHA verification routine that looped over guessed method names inside a catch-all try/catch, which could silently fail open, with a single explicit call.
• Renamed plugin variables that collided with WordPress globals ($page, $per_page, $type, $tabs, $path, $file).
• Validated the outbound email alert address with is_email() before storing it.
• Expanded the External Services disclosure to state exactly what data is sent to Google reCAPTCHA and ipapi.co and when, and removed the outdated note about PHP sessions.
• Diagnostic error_log() calls in the hardening module now only run when WP_DEBUG is enabled.
• Renamed the "free plan" wording in the logs screen to "Community edition" and documented the 3 blocked-IP limit in this readme.
• Expanded "Requires at least" to 6.2 to reflect use of the %%i identifier placeholder in $wpdb->prepare().
• Updated "Tested up to" to 7.0.2.
• Prefixed all file-scope variables in admin templates with eloguard_ (WordPress.NamingConventions.PrefixAllGlobals).
• Replaced esc_sql() table-name interpolation with $wpdb->prepare() + %%i throughout dashboard, logs, email, and the migration routine, removing PluginCheck.Security.DirectDB.UnescapedDBParameter warnings.
• Annotated core hook calls (login_form, login_head, wp_login, etc.) in class-admin-url.php to suppress false-positive NonPrefixedHooknameFound warnings.
• Annotated the hardening module's root .htaccess write to suppress PluginCheck.CodeAnalysis.WriteFile.ABSPATHDetected.
• Added NoCaching ignore annotations on real-time security counts and one-time migration schema checks.

1.2

• Renamed the "ecs" prefix (too short per WordPress.org guidelines) to "eloguard" across all functions, classes, defines, hooks, transients, database tables, and option names
• Added automatic one-time migration so existing installs' settings, logs, and blocked IPs carry over from the old "ecs_" names to the new "eloguard_" names
• Removed global define('CONCATENATE_SCRIPTS', false) — script concatenation is now only disabled on this plugin's own admin pages, not site-wide
• Removed global define('DISABLE_WP_CRON', true) — the plugin now shows an admin notice with instructions instead of silently changing this site-wide setting for every other plugin
• Replaced define('FORCE_SSL_ADMIN', true) with WordPress core's force_ssl_admin() function, so enabling HTTPS enforcement no longer defines a raw global constant
• Fixed late-escaping issue on the admin menu icon CSS output

1.1 2026-05-08 Initial Public Release

• Removed all license-gated feature restrictions — all features are fully free
• Fixed unprepared database queries across dashboard and logs pages
• Replaced direct file operations with WP_Filesystem API
• Moved inline scripts and styles into wp_enqueue_script() / wp_enqueue_style() across all admin pages
• Added capability checks to all admin page files
• Fixed chart data arrays not being built from query results
• Improved security score calculation
• Fixed admin menu position to avoid conflicting with core WordPress menu items
• Performance optimizations — caching added to all dashboard queries