內容簡介
KHALAF Login Access Guard 是一款保護 WordPress 網站的外掛，能有效防範自動化機器人、暴力破解攻擊及憑證填充。它將標準的 /wp-login.php 路徑轉換為可自訂的私密 URL，並提供視覺化的 403 訪問拒絕頁面設計工具。
【主要功能】
• 自訂秘密登入 URL：可將 /wp-login.php 移至任意自訂路徑
• 視覺化訪問拒絕自訂器：全面控制背景顏色、邊框、陰影等
• 互動式即時預覽：在管理設定中即時預覽自訂的 403 頁面
• 雙語及 RTL 支援：原生支援阿拉伯語和英語的排版
• XML-RPC 攻擊防禦：可選擇阻擋針對 xmlrpc.php 的自動化攻擊
• 一鍵切換：隨時啟用或停用保護功能而不失去設計
外掛標籤
開發者團隊
原文外掛簡介
KHALAF Login Access Guard defends your WordPress website against automated bots, brute-force attacks, and credential stuffing by transforming the standard /wp-login.php path into a private, customizable URL of your choice.
Unlike typical hide-login plugins that simply display a generic 404 error or a blank screen, KHALAF Login Access Guard provides a dedicated visual customizer and a real-time live preview inside your dashboard to design a modern, branded 403 Access Denied page for blocked visitors.
Key Features
Custom Secret Login URL: Move /wp-login.php to any custom slug (e.g. /my-secret-door).
Visual Access Denied Customizer: Full control over background gradients/colors, card border radius, shadows, padding, icons, typography, and button styling.
Interactive Live Preview: Preview your custom 403 Forbidden page in real time directly from the admin settings before publishing.
Dual-Language & RTL Ready: Native support for Arabic and English with seamless RTL (right-to-left) typography and layout switching.
XML-RPC Attack Defense: Optional toggle to block automated attacks targeting xmlrpc.php.
Zero Disruption to Core Actions: Password recovery links with secure reset tokens, logout, privacy confirmations, and protected post actions continue working seamlessly.
Safe Redirect Option: Option to redirect unauthorized attempts to any custom URL on your domain instead of rendering the denied page.
One-Click Toggle: Activate or deactivate protection anytime without losing your customized design or settings.
Cryptographic Slug Generator: Generate secure, randomized login slugs using browser cryptographic randomness with one click.
Non-Intrusive Admin Notices: Dismissible dashboard reminders compliant with WordPress Guidelines.
Security Notes
The plugin does not alter the WordPress admin dashboard (/wp-admin). Once logged in, administrators and authors work normally.
Hiding your login URL provides a strong layer of defense against automated scanning bots, but should be combined with strong passwords and 2FA.
The redirect option restricts destination targets to the same site domain to eliminate open-redirect vulnerabilities.
Reserved system slugs (wp-admin, admin, login, xmlrpc, wp-json, etc.) are blocked from being set as the login slug.
All settings and requests are sanitized, validated, and escaped following WordPress coding standards.
