內容簡介
LyoGate 是一款提升 WordPress 登入安全性的外掛，取代預設的登入頁面，提供現代化的保護機制。所有設定均可在控制台的 LyoGate 選項中進行，無需外部帳號或第三方服務，確保安全性與便利性。
【主要功能】
• 算術驗證碼：登入前需解答簡單數學題
• 每 IP 鎖定：多次登入失敗後鎖定 IP
• 隱藏蜜罐：自動拒絕填寫隱藏欄位的機器人
• 統一錯誤訊息：避免使用者名稱枚舉
• 可自訂外觀：調整標題、顏色及字型
• 相容性強：與其他外掛及 WordPress 流程兼容
外掛標籤
開發者團隊
原文外掛簡介
LyoGate replaces the default WordPress login page with a modern, protected one. Everything is configured from Settings → LyoGate. No external accounts, no third-party services: everything runs on your own site.
Security
Arithmetic captcha — a simple sum is required before signing in, backed by an HMAC-signed token with expiry (10 minutes): the answer never travels in clear text and is never stored in the database.
Per-IP brute-force lockout — after N failed attempts (default 5) the IP address is locked out for X minutes (default 15). Wrong captcha and honeypot hits count too; a successful login resets the counter. The lockout applies even with correct credentials.
Honeypot — a field hidden from humans: whoever fills it in is a bot and gets rejected without hints.
Unified error messages — no username enumeration: “unknown user” and “wrong password” produce the same generic message.
Reduced attack surface — XML-RPC disabled, X-Pingback header removed, public REST user endpoints removed (they remain available to users who can edit posts, for the block editor), and ?author=N requests plus author archives redirect to the home page: no username scraping.
Customizable appearance
Title, subtitle and footer message
Custom logo from the media library, with a configurable clickable link (empty = site home)
Two Google Fonts to choose from: Syne, Instrument Sans, Inter, Space Grotesk, Manrope, DM Sans, Outfit, Sora, Archivo, Playfair Display and JetBrains Mono (one for headings, one for body text)
Three colors: background, text and accent (buttons and focus)
Compatibility
The security gate runs as a late filter on the authenticate flow: captcha and lockout always take precedence over valid credentials. The gate only acts on the wp-login.php form: XML-RPC is disabled entirely while LyoGate is active, and application password / REST requests follow the normal WordPress flow (should another plugin re-enable XML-RPC, its authentication is not intercepted by the captcha).
All settings live in a single database option; on uninstall, options and transients are removed (also on multi-site).
