Zashita 24/7 Security: Custom Login URL & Core Integrity
| 开发者 | prohortech |
|---|---|
| 更新时间 | 2026年11月11日 14:35 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Zashita 24/7 (Russian for "protection 24/7") closes the most common doors bots knock on every day. The admin interface is in Russian.
Custom login URL
- Replace wp-login.php with your own address, for example
example.com/in-k7m2x9pq/. - Visitors who open wp-login.php or /wp-admin/ without being logged in get the theme's "not found" page.
- Log out, lost password, password reset, registration and the links in WordPress emails keep working at the new address.
- Forms that use admin-ajax.php or admin-post.php, the REST API, WP-Cron and the WooCommerce account page are not affected.
- The password form of protected posts stays on wp-login.php so the new address is not shown to visitors.
- No core files or .htaccess are modified. Deactivate the plugin and wp-login.php works again.
- The new address is emailed to the site administrator when it changes.
- Lost the address? Add
define( 'ZSHT_LOGIN_URL_OFF', true );to wp-config.php, or rename the plugin folder over FTP.
- Compares every file in wp-admin and wp-includes with the official checksums from WordPress.org for your version and locale.
- Lists modified, missing and unexpected files, including PHP files in the site root that are not part of WordPress.
- Successful and failed logins with date, username, IP address, browser and method (login form, XML-RPC, REST API).
- Records are deleted automatically after 7–90 days (30 by default). Suggested privacy policy text is added to the WordPress privacy guide.
- PHP version, file editor, public debug.log, XML-RPC, visible usernames and the login URL — what is at risk and why.
安装:
- Install and activate the plugin.
- Open "WP-ADDON → Защита 24/7" in the admin menu.
- On the "Адрес входа" tab, enable the custom login URL, save, and bookmark the new address.
- On the "Проверка ядра" tab, run the core integrity check.
屏幕截图:
常见问题:
I forgot my new login address
Check the email sent to the site administrator. Or add define( 'ZSHT_LOGIN_URL_OFF', true ); to wp-config.php: the standard wp-login.php will work again until you remove the line.
Does it work with page caching?
Yes. The login page sends no-cache headers and defines DONOTCACHEPAGE. If you use server-level caching (nginx, CDN), exclude the new address from the cache.
Does it support multisite?
Not yet. On multisite the custom login URL is disabled and wp-login.php works as usual.
Is a custom login URL enough to protect the site?
No. It stops automated password guessing on wp-login.php, but the address can still be seen, for example in the "Log in to reply" link. Use strong passwords as well.
更新日志:
1.0.2
- Code cleanup after Plugin Check: the WP-ADDON menu no longer uses shared hooks.
- The plugin page moved to the shared WP-ADDON admin menu together with other wp-addon.ru plugins.
- First release: custom login URL, core integrity check, login log, security checklist.