ZA Creative Login Shield
| 开发者 | sipho213 |
|---|---|
| 更新时间 | 2026年6月22日 00:16 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Two-Factor Authentication (2FA) - Email OTP and Google Authenticator (TOTP) support with per-role enforcement.
- Login Rate Limiting - Automatically block IPs after configurable failed attempts with adjustable lockout duration.
- IP Blocking & Whitelist - Manual and automatic IP blocking with dedicated whitelist management and Cloudflare IP range import.
- Custom Login URL - Hide wp-admin and wp-login behind a custom slug to block automated attacks.
- Security Dashboard - Weighted security score (100 pts), 14-day stacked bar analytics, recommendations engine, and quick actions.
- Password Policy - Enforce minimum length, uppercase, lowercase, digits, and special characters.
- Session Management - Track active sessions with idle timeout enforcement.
- Device Fingerprinting - Detect and track known devices with alerts for new device logins.
- Emergency Lockdown - One-click full site lockdown with IP whitelist override.
- Country Intelligence - GeoIP lookup via ip-api.com to display country codes on login attempts and blocked IPs.
- Audit Trail - Complete action log for security events (settings changes, blocks, lockdown, reports).
- Scheduled Reports - Daily, weekly, or monthly email security summaries.
- Setup Wizard - Guided 5-step onboarding to configure core protections quickly.
- Dashboard Widgets - At-a-glance security score and recent activity on the WordPress admin dashboard.
- CSV Export - Export login attempt logs for external analysis.
- Cloudflare - One-click import of Cloudflare IP ranges to restore real visitor IPs.
- ip-api.com - Free GeoIP country lookup (no API key required).
安装:
- Upload the
za-creative-login-shieldfolder to the/wp-content/plugins/directory, or install directly through the WordPress plugin installer. - Activate the plugin through the 'Plugins' screen.
- Navigate to ZA Creative Login Shield in your WordPress admin sidebar to access the setup wizard and dashboard.
- Follow the 5-step setup wizard to configure your security settings, or configure each feature individually under ZA Creative Login Shield.
- WordPress 5.8 or higher.
- PHP 7.4 or higher.
屏幕截图:
常见问题:
Will this work with any WordPress theme?
Yes. ZA Creative Login Shield works with any WordPress theme. It does not modify theme templates and operates entirely through WordPress hooks and filters.
Does it conflict with other security plugins?
It is designed to complement other security measures like hosting-level firewalls. However, running multiple login protection plugins simultaneously may cause unexpected behavior. We recommend using ZA Creative as your primary login security solution.
Does it work with caching plugins?
Yes. The plugin respects WordPress hooks correctly and works with all major caching and CDN solutions.
How does the 2FA work?
Users can choose between Email OTP (one-time password sent via email) or Google Authenticator (TOTP via the Google Authenticator app). Each user can enable 2FA from their profile page, and administrators can enforce 2FA for specific user roles.
How does the custom login URL work?
The plugin creates a custom login page at a URL you define (default: /be-login/). When enabled, the standard /wp-login.php and /wp-admin/ (for non-logged-in users) are blocked, effectively hiding your login page from automated bots.
Does the plugin collect user data?
The plugin stores only security-related data (login attempts, IP addresses, session tokens, device fingerprints) in your WordPress database. No visitor data is sent to external services except optional GeoIP lookups via ip-api.com (when an IP is logged). An admin-initiated Cloudflare IP range fetch contacts api.cloudflare.com but sends no visitor data. GeoIP data is cached for 7 days and does not require an API key.
Can I delete all plugin data?
Yes. When you uninstall the plugin via WordPress, all database tables and options are automatically removed. This includes login logs, blocked IPs, 2FA status, sessions, device fingerprints, lockdown settings, and audit trail entries.
更新日志:
- Removed Author URI and Plugin URI (timeout issues).
- Updated stable version to 4.0.3.
- Removed WooCommerce requires/tested headers.
- Fixed broken UTF-8 characters in readme.txt.
- Added Privacy section to readme.txt.
- Added esc_sql() to uninstall DROP TABLE queries.
- Database migration now detects missing columns on MySQL 5.7.
- Column-existence checks added to login recording methods.
- Complete plugin rename to ZA Creative Login Shield with new slug and text domain.
- Moved admin menu to Settings > ZA Creative Login Shield via add_options_page().
- Replaced wp_hash() with hash('sha256') for device fingerprinting per security best practices.
- Hashed IP addresses in transient and cache keys to prevent database pollution.
- Removed all auth secret/salt usage from device tracking.
- Added External Services section to readme.txt documenting Cloudflare API and ip-api.com.
- Updated contributor information.
- Removed bundled screenshot and banner assets per WordPress.org guidelines.
- Full security review: sanitization, nonces, capabilities, escaping verified.
- Compliance with WordPress Plugin Directory Guidelines and Plugin Check requirements.
- Added audit trail with action filtering and clear functionality.
- Added country intelligence via ip-api.com GeoIP lookup.
- Added scheduled email security reports (daily/weekly/monthly).
- Added 5-step guided setup wizard replacing the old onboarding.
- Added WordPress Dashboard widgets (security score + recent activity).
- Added successful login recording to analytics chart.
- Added security score recommendations engine.
- Added dedicated IP whitelist management subpage.
- Added Cloudflare IP range import via AJAX.
- Redesigned dashboard with weighted score, 14-day chart, and quick action grid.
- Enhanced setup wizard with step indicators and AJAX step-saving.
- Initial release with 2FA (Email OTP + TOTP), login rate limiting, IP blocking, custom login URL, security dashboard, password policy, session management, device fingerprinting, emergency lockdown, and CSV export.