內容簡介
LoginHush 是一款能夠替換 WordPress 公共登入地址為私密路徑的外掛，並提供額外的安全層級。它能有效減少自動化登入流量，並保護網站免受未經授權的訪問。
【主要功能】
• 自訂私密登入路徑
• 清晰的登入路徑管理
• 阻擋直接訪問 wp-login.php
• 隨機路徑生成與衝突檢查
• 可配置的登入失敗率限制
• 隱私友好的活動日誌
外掛標籤
開發者團隊
② 後台搜尋「LoginHush – Private Login URL & Access Guard」→ 直接安裝（推薦）
原文外掛簡介
LoginHush replaces the public WordPress login address with a private path without renaming core files. Its optional security layer uses transients for active rate limits and one compact indexed table for the activity log. On Apache sites using Plain permalinks, it maintains one narrowly scoped rule inside a dedicated LoginHush section of .htaccess.
The plugin starts disabled after activation. An administrator must test the candidate path successfully in the browser before protection can be enabled. This prevents the most common accidental lockout scenario.
Features
Custom private login path.
Clean login paths on Apache even when WordPress Plain permalinks are selected.
Safe query-string fallback when a clean-path rule cannot be installed.
Blocks direct access to wp-login.php and logged-out access to wp-admin.
Choose a real 404 response or a safe local redirect for blocked requests.
Browser-based safety test before enabling a new path.
Random path generator and collision checks.
Preserves AJAX, admin-post, cron, REST, XML-RPC, WP-CLI, post-password, and WordPress recovery-mode requests.
Rewrites WordPress-generated login, logout, registration, and password-reset URLs.
WP-CLI status, URL, path-change, enable, and disable commands.
wp-config.php emergency bypass.
Page-cache detection warning.
Configurable failed-login rate limiting with progressive temporary lockouts.
Optional login honeypot.
Throttled email and signed generic webhook alerts.
Privacy-friendly activity log with automatic retention cleanup.
Trusted-proxy configuration for Cloudflare and other reverse proxies.
IPv4/IPv6 allowlist, denylist, and CIDR support.
Clean uninstall.
Security scope
Changing the login URL and limiting failed attempts reduce common automated login traffic. They are defensive layers, not replacements for strong passwords, software updates, or two-factor authentication.
LoginHush does not block XML-RPC authentication. When activity logging is enabled, it stores masked IP addresses, site-salted hashes, event metadata, and hashed login identities for the configured retention period. Raw IP addresses and usernames are not stored in the log. Email and webhook connections occur only when explicitly enabled.
WP-CLI
wp loginhush status
wp loginhush url
wp loginhush set-slug new-private-path
wp loginhush enable
wp loginhush disable
