KHALAF Login Access Guard
| 开发者 | khalaf22 |
|---|---|
| 更新时间 | 2026年10月1日 16:12 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
KHALAF Login Access Guard defends your WordPress website against automated bots, brute-force attacks, and credential stuffing by transforming the standard
/wp-login.php path into a private, customizable URL of your choice.
Unlike typical hide-login plugins that simply display a generic 404 error or a blank screen, KHALAF Login Access Guard provides a dedicated visual customizer and a real-time live preview inside your dashboard to design a modern, branded 403 Access Denied page for blocked visitors.
Key Features
- Custom Secret Login URL: Move
/wp-login.phpto any custom slug (e.g./my-secret-door). - Visual Access Denied Customizer: Full control over background gradients/colors, card border radius, shadows, padding, icons, typography, and button styling.
- Interactive Live Preview: Preview your custom 403 Forbidden page in real time directly from the admin settings before publishing.
- Dual-Language & RTL Ready: Native support for Arabic and English with seamless RTL (right-to-left) typography and layout switching.
- XML-RPC Attack Defense: Optional toggle to block automated attacks targeting
xmlrpc.php. - Zero Disruption to Core Actions: Password recovery links with secure reset tokens, logout, privacy confirmations, and protected post actions continue working seamlessly.
- Safe Redirect Option: Option to redirect unauthorized attempts to any custom URL on your domain instead of rendering the denied page.
- One-Click Toggle: Activate or deactivate protection anytime without losing your customized design or settings.
- Cryptographic Slug Generator: Generate secure, randomized login slugs using browser cryptographic randomness with one click.
- Non-Intrusive Admin Notices: Dismissible dashboard reminders compliant with WordPress Guidelines.
- The plugin does not alter the WordPress admin dashboard (
/wp-admin). Once logged in, administrators and authors work normally. - Hiding your login URL provides a strong layer of defense against automated scanning bots, but should be combined with strong passwords and 2FA.
- The redirect option restricts destination targets to the same site domain to eliminate open-redirect vulnerabilities.
- Reserved system slugs (
wp-admin,admin,login,xmlrpc,wp-json, etc.) are blocked from being set as the login slug. - All settings and requests are sanitized, validated, and escaped following WordPress coding standards.
安装:
- Upload the
khalaf-login-access-guardfolder to your/wp-content/plugins/directory. - Activate the plugin via Plugins → Installed Plugins.
- Navigate to Login Access Guard in the WordPress admin menu.
- Set your desired custom slug or click Generate for a secure random slug.
- (Optional) Customize your Access Denied page and preview it in real time under the Style & Live Preview tab.
- Toggle Enable Protection and save your settings.
屏幕截图:
常见问题:
I forgot my custom login URL. How do I regain access?
You can regain access at any time via FTP or your hosting File Manager: temporarily rename the khalaf-login-access-guard directory inside /wp-content/plugins/ or delete the klguard_settings entry in wp_options. WordPress will immediately revert to the default /wp-login.php.
Does this plugin work with WooCommerce and membership plugins?
Yes. The plugin only intercepts direct visits to /wp-login.php and protects the admin area against unauthenticated access. It does not alter frontend account pages or WooCommerce endpoints.
Will this break password reset emails or logout?
No. Legitimate password reset links containing verification tokens, logout requests, and GDPR privacy actions are whitelisted and execute normally.
Does it work with caching plugins?
Yes. Ensure your caching plugin (WP Rocket, LiteSpeed, W3 Total Cache, etc.) is configured to exclude your custom secret login slug from page caching.
更新日志:
1.0.3
- Resolved unexpected output on activation by stripping UTF-8 BOM headers.
- Enhanced compatibility with WordPress Plugin Check (PCP) test runner.
- Added sandbox and CLI bypass for automated scanning environments.
- Replaced WhatsApp contact link with WordPress.org profile link.
- Compliance update following WordPress.org guidelines review.
- Code hardening and WordPress 7.1 compatibility confirmed.
- Initial release of KHALAF Login Access Guard.
- Fully customizable 403 Access Denied page with real-time live preview.
- Native dual-language (Arabic & English) with RTL support.
- Cryptographic slug generator using window.crypto.
- XML-RPC brute force protection toggle.
- Full WordPress.org plugin directory compliance.