MSC Stealth Login
| 开发者 | djm56 |
|---|---|
| 更新时间 | 2026年8月27日 22:44 |
| 捐献地址: | 去捐款 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
/wp-login.php to a custom URL like /secure-login/. Attackers scanning for standard WordPress login pages are redirected away before they can even attempt a brute force attack.
wp-admin Protection
Block direct access to /wp-admin/ for users who aren't logged in — they're silently redirected to a URL you choose. Logged-in users and AJAX requests are unaffected.
Brute Force Protection (enable Advanced Security to arm)
After a configurable number of failed login attempts (default 3), the IP is locked out for a configurable duration (default 15 minutes). With progressive lockouts enabled, each successive lockout doubles the wait time, up to your configured maximum. This stops automated attacks while minimizing disruption to real users who mistype their password.
Email Notifications
Stay informed about security events with configurable email alerts:
- Lockout notifications when IPs are blocked
- Admin login alerts for every administrator sign-in
- New IP alerts when users log in from previously unseen locations
10.0.0.0/8). Add your office, home, or server IPs to ensure uninterrupted access while maintaining maximum security for everyone else. A proxy-header trust toggle supports Cloudflare and reverse-proxy setups.
Emergency Recovery URL
Forgot your custom login URL? The Settings tab shows a secure recovery URL that always reaches wp-login.php — copy it, bookmark it, or email it to yourself from the Support tab. You can regenerate it at any time.
Private by design
No external services, no CDN assets, no tracking. Login data stays in your database, is clearable from the History tab, auto-pruned after 30 days, and fully removed on uninstall.
安装:
- Upload the plugin files to
/wp-content/plugins/msc-stealth-login/directory - Activate the plugin through the 'Plugins' menu in WordPress
- Navigate to Settings → MSC Stealth Login
- Configure your custom login URL (e.g.,
/secure-login/) - Enable additional security features as needed (brute force protection, email alerts, etc.)
- Save your recovery URL somewhere safe — bookmark it or store it securely
屏幕截图:
常见问题:
How do I hide my WordPress login page?
Install and activate the plugin, go to Settings → MSC Stealth Login, and set a custom login slug (e.g. my-secret-door). Save — your login page now lives at yoursite.com/my-secret-door and wp-login.php no longer works for visitors. Bookmark the new URL and the Emergency Recovery URL immediately.
What happens when someone visits wp-login.php or wp-admin?
They are silently redirected (HTTP 302) to a URL you choose — the homepage by default. There's no error page revealing that a protection plugin is running. Logged-in users, logout/password-reset flows, and AJAX requests keep working normally.
How do I block access to /wp-admin?
Enable "Hide wp-admin" on the Settings tab. Logged-out visitors who try to open any /wp-admin URL are silently redirected to a URL you choose (your homepage by default), while logged-in users and AJAX requests are unaffected. Combined with the custom login URL, this hides both your login page and your admin area from bots and vulnerability scanners.
What happens if I forget my custom login URL?
Use the Emergency Recovery URL shown on the Settings tab — copy or bookmark it when you set up the plugin (you can also email yourself the login URL from the Support tab). The recovery URL always reaches wp-login.php. If you lose both, rename the plugin folder via FTP/SFTP or run wp plugin deactivate msc-stealth-login — deactivating instantly restores the standard login page.
How do I recover access if I'm locked out?
Wait for the lockout period to expire, or use the Emergency Recovery URL. For immediate access, disable the plugin via FTP by renaming the plugin folder. Your IP can also be added to the allowlist if you have database access.
How does brute-force protection work?
Enable Advanced Security Features on the Advanced tab (it ships disabled so nothing surprises you). Then, after the configured number of failed attempts (default 3) from one IP, that IP is locked out for the configured duration (default 15 minutes). Optional progressive lockouts double the wait after each repeat offence, capped at your configured maximum. Successful logins reset the counter.
Can I allowlist my own IP so I'm never locked out?
Yes. Add exact IPs or CIDR ranges (IPv4 and IPv6) to the whitelist on the Advanced tab. Behind Cloudflare or a reverse proxy? Enable "Trust Proxy Headers" so the plugin sees real visitor IPs instead of the proxy's.
Does it work on WordPress Multisite?
Yes. Activate it network-wide or per site — either way every site gets its own custom login URL, settings, login history and emergency recovery URL, and sites created later are set up automatically. Each site's administrator configures it under Settings → MSC Stealth Login on their own site. By default failed-login counters are per site; enable "Share Lockouts Across Network" on the Advanced tab if you want a lockout earned on one site to apply across the whole network. Uninstalling removes the plugin's data from every site on the network.
Does it block XML-RPC attacks and user enumeration?
Yes, both are on by default once Advanced Security is enabled. XML-RPC pingback and user-listing methods are disabled, and the REST API user endpoints plus ?author=N queries are blocked. Note: disabling XML-RPC affects the WordPress mobile app and some Jetpack features — leave it off if you use those.
Does this work with caching plugins?
Yes, but ensure your login pages aren't cached — exclude your custom login URL from caching. The plugin detects six major cache/security plugins (W3 Total Cache, WP Super Cache, WP Rocket, Wordfence, iThemes Security, Sucuri) and shows a heads-up notice when one is active.
Can I run it alongside Wordfence or other security plugins?
Generally yes, but avoid overlapping features — if another plugin also limits login attempts or hides the login page, disable that feature in one of the two. Test on staging before production.
Does it work with WooCommerce login forms?
WooCommerce's My Account login page is separate and keeps working. The plugin protects wp-login.php and wp-admin; test your specific checkout/membership flows on staging.
How do the email notifications work?
Navigate to Settings → MSC Stealth Login → Email tab. Enable the notifications you want and customize the subject and body using placeholders: {ip}, {attempts}, {time}, {site_name}, {site_url}. Notifications are sent immediately when events occur.
What data does it store? Is it GDPR-friendly?
Login attempts (IP, username, result, user agent, timestamp) are stored in your own database only — nothing is sent externally and there are no cookies or third-party requests. History is clearable from the History tab, auto-pruned after 30 days, and the table is removed completely on uninstall.
Is anything locked or paid?
No. Every feature is included in the plugin you download — there is nothing to unlock and no separate paid add-on.
更新日志:
- Tested with WordPress 7.1. No functional changes.
- Added: Multisite support — every site on a network now gets its own login-attempts table, settings and emergency recovery token, whether activated per site or network-wide, and new sites are set up automatically.
- Added: Optional "Share Lockouts Across Network" setting (Advanced tab, multisite only) so failed-login counters and progressive lockouts can be counted network-wide instead of per site.
- Fixed: Login History filters (IP, username, result, date) were silently ignored in the table, the entry count and the CSV export.
- Fixed: Fatal error when viewing Login History on WordPress 5.9–6.2 caused by calling a function that only exists in WordPress 6.3+.
- Fixed: The Filter and Clear Filters buttons on the History tab bounced you back to the Settings tab.
- Fixed: Export to CSV now exports the filtered view instead of everything, and no longer stops at 1,000 rows.
- Fixed: Uninstalling on a multisite network now cleans up every site, not just the current one.
- Changed: Support now links to the plugin's WordPress.org support forum instead of the old contact button.
- Added: Automatic login-history pruning — entries older than 30 days are now cleaned up daily (filterable via
mscsl_log_retention_days). - Added: One-time, dismissible review request on the settings page (shown 7+ days after activation).
- Added: "Email Me My Login URL" form on the Support tab so you can keep the custom login URL on record.
- Fixed: Documentation incorrectly said the Emergency Recovery URL appears in the admin bar — it is shown on the Settings tab.
- Improved: WordPress.org listing rewritten — clearer title, searchable tags, expanded FAQ (incl. blocking /wp-admin), refreshed screenshot captions, and accurate description of which protections require the Advanced Security toggle.
- Tested with WordPress 7.0.2. No functional changes.
- Fixed: Updated plugin metadata to WordPress 7.0 compatibility (
Tested up to: 7.0). - Fixed: Renamed global init callback to prefixed function name for Plugin Check naming compliance.
- Fixed: Removed discouraged
load_plugin_textdomain()call for WordPress.org translation loading compliance. - Fixed: Refactored login history SQL query assembly to avoid interpolated dynamic WHERE fragments and ensure placeholder/replacement parity in
$wpdb->prepare(). - Fixed: Replaced direct
usermetacleanup queries in uninstall withdelete_metadata()API. - Updated: Release version bumped to
1.0.8.
- Security: Fixed IP spoofing vulnerability — now defaults to REMOTE_ADDR; proxy headers only trusted when explicitly enabled via new
trust_proxyoption. - Security: Removed broad
redirect_toexception that allowed bypassing login block. - Security: Added CSV formula injection prevention for data exports.
- Fixed: Added
load_plugin_textdomain()so translation files are loaded correctly. - Fixed: Converting closures to named methods for removability.
- Fixed: Added
settings_errors()output on settings page. - Fixed: Refactored SQL sentinel pattern to dynamic WHERE clauses for index utilisation.
- Fixed: URL-safe validation for custom login slug.
- Fixed: Synchronized reserved slug list between PHP and JavaScript.
- Fixed: Double-escaping in login URL display.
- Fixed:
esc_attr_e()in JS onclick handlers replaced withesc_js(). - Fixed:
esc_html__()in plain text email bodies replaced with__(). - Fixed:
esc_html__()inwp_localize_script()replaced with__(). - Fixed:
esc_url()in input value attributes replaced withesc_attr(). - Fixed: Timezone-sensitive date calculation using
gmdate()+DAY_IN_SECONDS. - Fixed: Incomplete translator comment for lockout email.
- Fixed: Orphan user meta cleanup on uninstall.
- Fixed:
delete_transient()instead ofdelete_option()for transients.
- Fixed: Removed inline
<script>from data tracking notice and moved dismiss logic to admin.js with localized nonce (WordPress.org review compliance). - Fixed: Replaced hardcoded
/wp-login.phpURL paths withwp_login_url()+add_query_arg()for subdirectory WordPress compatibility. - Fixed: Added missing translators comment for data tracking notice string (Plugin Check compliance).
- Fixed: Added phpcs:ignore comments for custom table direct database queries (Plugin Check compliance).
- Fixed: CIDR IP whitelist matching now works correctly for subnet ranges.
- Fixed: Recovery token comparison now uses timing-safe comparison (hash_equals).
- Fixed: Lockout message output now properly escaped.
- Fixed: Recovery token option key renamed from msc_recovery_token to mscsl_recovery_token for namespace consistency, with automatic migration.
- Fixed: Plugin header tab character removed for parser compatibility.
- Added: Privacy admin notice informing administrators about data collection (IP addresses, usernames, user agents, login history).
- Added: Database schema version tracking for future upgrade path.
- Added: Privacy Policy section to plugin documentation.
- Changed: Inlined CSS styles on error page elements for simpler standalone page rendering.
- Removed: External CSS file for error pages (no longer needed).
- Removed: Frontend style registration hooks (no longer needed).
- Fixed: Extracted inline CSS to external stylesheet file per WordPress.org review requirements.
- Fixed: Created template files for lockout and blocked error pages.
- Added: X-Frame-Options and X-Content-Type-Options security headers to error pages.
- Fixed: Plugin Check errors for unescaped database parameters in query methods.
- Fixed: Plugin Check error for fclose() on php://output stream — added phpcs:ignore.
- Fixed: DROP TABLE query now uses direct query instead of prepare() (table names cannot be prepared).
- Fixed: Added phpcs:ignore comments for nonce verification warnings in frontend security filters.
- Fixed: Added cleanup of flush rewrite rules transient in uninstall.
- Fixed: Custom login URL now works immediately after plugin activation without manual permalink flush.
- Fixed: Custom login URL now works immediately after changing the slug in settings.
- Initial release
- Custom login URL with rewrite rules
- wp-admin blocking and redirect
- Brute force protection with configurable lockouts
- Email notifications (lockout, admin alert, new IP)
- Login history with filtering and CSV export
- XML-RPC endpoint disable option
- REST API user enumeration blocking
- IP whitelist for bypassing protection
- Progressive lockout delay multiplier
- Recovery URL system for forgotten login URLs