Mrsea Login

Mrsea Login brings a green-and-ivory design to the WordPress login page and lets site administrators choose a custom login URL. Users can add an extra verification step with a time-based authenticator app. Login design

• Responsive desktop and mobile layouts.
• Readable form guidance, keyboard focus styles and password visibility control.
• Headings for login, registration and password-reset screens.
• Uses your existing site title. No remote fonts are loaded.

Custom login URL

• Choose your login slug under Settings > Mrsea Login.
• Redirect visitors away from the default login routes.
• Preserve normal password reset and registration routes through the custom URL.
• Changing the URL reduces exposure of the default route; it is not a replacement for authentication or other site security.

Optional two-factor authentication

• Compatible with Google Authenticator and standard TOTP apps using SHA-1, six digits and 30-second intervals.
• Scan a locally generated QR code or enter the setup key manually.
• Verify a code before protection is enabled for the account.
• Ten one-use recovery codes, with password-and-code verification to regenerate them.
• Encrypted authenticator secrets and hashed recovery codes.
• Retry limits and protections against reusing an accepted code.
• Existing enrollments and recovery codes are retained when updating from version 1.2.0.

Two-factor protection is optional and configured per account. Installing the plugin alone does not enable it for all users. HTTPS and PHP OpenSSL with AES-256-GCM support are required for enrollment. Privacy and external services Mrsea Login does not use a Google API, send setup secrets to a QR service, or load a remote QR library. The QR code is rendered in the user's browser using bundled JavaScript. The plugin adds no analytics or telemetry. The plugin stores the login/redirect slugs in options and the encrypted authenticator secret, last accepted time step and hashed recovery codes in user metadata. Pending setup data expires after ten minutes. Retry counters expire after five minutes. Short-lived database lock rows serialize security changes and are removed after use; abandoned locks can be recovered after sixty seconds. Deactivation stops Mrsea Login's protections. Uninstalling does not automatically erase enrollment data or settings; this supports reinstallation without silently removing saved security configuration. A verified site administrator can remove an account's _mrsea_login_two_factor user-meta entry when intentionally resetting its enrollment. Do not remove another user's security settings without identity verification. Compatibility and security boundaries

• Back up the site and bookmark the custom URL before enabling or changing settings.
• Enabling 2FA signs out the user's other browser sessions.
• Application passwords, including existing ones, are unavailable for enrolled accounts while 2FA is on. Review integrations before enabling. Disabling 2FA makes those application passwords available again.
• Other forms using wp_authenticate/wp_signon must provide the mrsea_login_otp field for enrolled users. Password-only attempts fail.
• SSO or membership plugins that issue login cookies without WordPress authentication filters are outside this enforcement. Test compatibility first.
• Keep server and phone clocks synchronized. Accepted clock skew is one 30-second step in either direction. A used code cannot be reused, including the enrollment code.
• WordPress authentication salts are used for secret encryption. Back up wp-config.php securely. Changing salts requires authenticator re-enrollment; saved recovery codes still work.
• Password resets do not remove 2FA. Logged-in sessions do not request a new code on every page load.
• This plugin is not a firewall, malware scanner or guarantee against account compromise.

Google Authenticator is a trademark of Google LLC. Mrsea Login is an independent plugin and is not affiliated with or endorsed by Google or WordPress.

1.4.7

• Restored the proven custom-login request handoff used by the tested predecessor while retaining Mrsea Login's WordPress.org-compliant naming, security controls and safe blocked-login redirect.

1.4.6

• Replaced the final custom-login handoff with an earliest-priority template interceptor so themes and canonical 404 redirects cannot take over the configured login URL.

1.4.5

• Added a parsed-request fallback so the configured custom login URL loads before a theme or hosting stack can resolve it as a 404 page.

1.4.4

• Fixed custom login routes returning the site's 404 page on hosting stacks that normalise requests after plugins load.
• Improved custom-route matching for root and subdirectory WordPress installations.

1.4.3

• Fixed direct visits to wp-login.php so they use the configured blocked-login redirect instead of displaying the login screen.
• The settings page now shows when two-factor authentication is already enabled and links to management controls.

1.4.2

• Removed manual loading of the WordPress template loader and now allows the normal WordPress request lifecycle to render blocked-login responses.

1.4.1

• Replaced short custom prefixes with the unique mrsea_login prefix.
• Migrates settings and authenticator enrollment data from the predecessor.

1.4.0

• Renamed to Mrsea Login with the mrsea-login text domain and directory.
• Corrected the contributor username to mrsea.
• Retained saved login and authenticator settings during the rename.
• Added a guard against running alongside the previous plugin.

1.3.0

• Added green-and-ivory responsive login design and action-aware headings.
• Improved authenticator guidance contrast and remember-me alignment.
• Added local QR-code setup alongside manual entry and a copy-key button.
• Preserved existing authenticator enrollment, recovery codes and hidden-login settings.

1.2.0

• Added optional per-user authenticator TOTP, verified enrollment and encrypted secrets.
• Added ten one-use recovery codes, retry limits, verification locks and replay prevention.

1.1.0

• Added custom hidden login URL and blocked-login redirect settings.

1.0.0

• Initial custom login design.