LoginHush – Private Login URL & Access Guard

LoginHush replaces the public WordPress login address with a private path without renaming core files. Its optional security layer uses transients for active rate limits and one compact indexed table for the activity log. On Apache sites using Plain permalinks, it maintains one narrowly scoped rule inside a dedicated LoginHush section of .htaccess. The plugin starts disabled after activation. An administrator must test the candidate path successfully in the browser before protection can be enabled. This prevents the most common accidental lockout scenario. Features

• Custom private login path.
• Clean login paths on Apache even when WordPress Plain permalinks are selected.
• Safe query-string fallback when a clean-path rule cannot be installed.
• Blocks direct access to wp-login.php and logged-out access to wp-admin.
• Choose a real 404 response or a safe local redirect for blocked requests.
• Browser-based safety test before enabling a new path.
• Random path generator and collision checks.
• Preserves AJAX, admin-post, cron, REST, XML-RPC, WP-CLI, post-password, and WordPress recovery-mode requests.
• Rewrites WordPress-generated login, logout, registration, and password-reset URLs.
• WP-CLI status, URL, path-change, enable, and disable commands.
• wp-config.php emergency bypass.
• Page-cache detection warning.
• Configurable failed-login rate limiting with progressive temporary lockouts.
• Optional login honeypot.
• Throttled email and signed generic webhook alerts.
• Privacy-friendly activity log with automatic retention cleanup.
• Trusted-proxy configuration for Cloudflare and other reverse proxies.
• IPv4/IPv6 allowlist, denylist, and CIDR support.
• Clean uninstall.

Security scope Changing the login URL and limiting failed attempts reduce common automated login traffic. They are defensive layers, not replacements for strong passwords, software updates, or two-factor authentication. LoginHush does not block XML-RPC authentication. When activity logging is enabled, it stores masked IP addresses, site-salted hashes, event metadata, and hashed login identities for the configured retention period. Raw IP addresses and usernames are not stored in the log. Email and webhook connections occur only when explicitly enabled.

1.5.1

• Prefixed all variables assigned in included templates and multisite uninstall scope for Plugin Check compliance.

1.5.0

• Matched the text domain and package folder to the assigned WordPress.org slug.
• Replaced all collision-prone declarations, stored-data keys, hooks, handles, and request parameters with the unique logiprlo_ prefix.
• Updated the WordPress.org contributor username to jayanta77.

1.4.0

• Prepared the plugin branding and packaging for WordPress.org submission.

1.3.4

• Added the declared translation directory for plugin-header validation.
• Removed the obsolete manual translation loader on modern WordPress.
• Safely prepared the custom-table identifier during uninstall.

1.3.3

• Moved all toggle checkboxes to the left of their labels and descriptions.

1.3.2

• Added consistent spacing between standalone setting labels and their controls.

1.3.1

• Kept every contextual-help icon inline immediately after its label text.

1.3.0

• Added lightweight contextual help tooltips throughout the Protection settings.
• Tooltips support mouse hover, keyboard focus, and touch focus without JavaScript.

1.2.2

• Moved the activity-log checkbox to the left of its label and description.

1.2.1

• Fixed the activity-retention checkbox stretching across the settings card.

1.2.0

• Added configurable failed-login rate limiting and progressive lockouts.
• Added an optional honeypot, email alerts, and signed generic webhooks with throttling.
• Added privacy-friendly activity logging with retention cleanup.
• Added trusted-proxy handling and IPv4/IPv6 allowlist and denylist rules.
• Added focused Access, Protection, and Activity settings tabs.

1.1.0

• Added clean private login paths for Apache sites using Plain permalinks.
• Added scoped .htaccess rule installation, update, deactivation, and error reporting.
• Retained the query-string route as a fallback when clean rules are unavailable.

1.0.2

• Fixed undefined login-controller variables after logout when WordPress debugging output is enabled.
• Prevented PHP warning markup from appearing inside the login username field.

1.0.1

• Fixed first-time enabling being reverted by WordPress's second settings-sanitization pass.
• Prevented duplicate success and safety-test error notices after saving.

1.0.0

• Initial release.