內容簡介
Mrsea Login 是一款專為 WordPress 登入頁面設計的外掛，提供綠色與象牙色的美觀介面，並允許網站管理員自訂登入 URL。用戶可選擇額外的時間基礎驗證步驟，增強帳戶安全性。
【主要功能】
• 自訂登入 URL，提升安全性
• 響應式設計，適用桌面與行動裝置
• 可選擇雙重驗證，支援 Google Authenticator
• 生成一次性恢復碼，增強帳戶保護
• 簡單易用的登入介面與指引
外掛標籤
開發者團隊
原文外掛簡介
Mrsea Login brings a green-and-ivory design to the WordPress login page and lets site administrators choose a custom login URL. Users can add an extra verification step with a time-based authenticator app.
Login design
Responsive desktop and mobile layouts.
Readable form guidance, keyboard focus styles and password visibility control.
Headings for login, registration and password-reset screens.
Uses your existing site title. No remote fonts are loaded.
Custom login URL
Choose your login slug under Settings > Mrsea Login.
Redirect visitors away from the default login routes.
Preserve normal password reset and registration routes through the custom URL.
Changing the URL reduces exposure of the default route; it is not a replacement for authentication or other site security.
Optional two-factor authentication
Compatible with Google Authenticator and standard TOTP apps using SHA-1, six digits and 30-second intervals.
Scan a locally generated QR code or enter the setup key manually.
Verify a code before protection is enabled for the account.
Ten one-use recovery codes, with password-and-code verification to regenerate them.
Encrypted authenticator secrets and hashed recovery codes.
Retry limits and protections against reusing an accepted code.
Existing enrollments and recovery codes are retained when updating from version 1.2.0.
Two-factor protection is optional and configured per account. Installing the plugin alone does not enable it for all users. HTTPS and PHP OpenSSL with AES-256-GCM support are required for enrollment.
Privacy and external services
Mrsea Login does not use a Google API, send setup secrets to a QR service, or load a remote QR library. The QR code is rendered in the user’s browser using bundled JavaScript. The plugin adds no analytics or telemetry.
The plugin stores the login/redirect slugs in options and the encrypted authenticator secret, last accepted time step and hashed recovery codes in user metadata. Pending setup data expires after ten minutes. Retry counters expire after five minutes. Short-lived database lock rows serialize security changes and are removed after use; abandoned locks can be recovered after sixty seconds.
Deactivation stops Mrsea Login’s protections. Uninstalling does not automatically erase enrollment data or settings; this supports reinstallation without silently removing saved security configuration. A verified site administrator can remove an account’s _mrsea_login_two_factor user-meta entry when intentionally resetting its enrollment. Do not remove another user’s security settings without identity verification.
Compatibility and security boundaries
Back up the site and bookmark the custom URL before enabling or changing settings.
Enabling 2FA signs out the user’s other browser sessions.
Application passwords, including existing ones, are unavailable for enrolled accounts while 2FA is on. Review integrations before enabling. Disabling 2FA makes those application passwords available again.
Other forms using wp_authenticate/wp_signon must provide the mrsea_login_otp field for enrolled users. Password-only attempts fail.
SSO or membership plugins that issue login cookies without WordPress authentication filters are outside this enforcement. Test compatibility first.
Keep server and phone clocks synchronized. Accepted clock skew is one 30-second step in either direction. A used code cannot be reused, including the enrollment code.
WordPress authentication salts are used for secret encryption. Back up wp-config.php securely. Changing salts requires authenticator re-enrollment; saved recovery codes still work.
Password resets do not remove 2FA. Logged-in sessions do not request a new code on every page load.
This plugin is not a firewall, malware scanner or guarantee against account compromise.
Google Authenticator is a trademark of Google LLC. Mrsea Login is an independent plugin and is not affiliated with or endorsed by Google or WordPress.
Moving from the previous plugin name
Mrsea Login is the renamed continuation of the earlier 1.3.x plugin.
Back up your site and keep an administrator session open. Install Mrsea Login,
then deactivate the old plugin and activate Mrsea Login. Do not run both.
Version 1.4.1 moves custom options and user metadata to the unique mrsea_login
prefix. Existing login slugs, encrypted secrets and recovery codes are imported
from the privately distributed predecessor when first needed.
Do not change WordPress salts during migration. Test in a private window.
If the previous plugin is still active, Mrsea Login pauses instead of running
its login hooks. A warning appears in the dashboard.
Credits
Mrsea Login by Seyi Aluko, licensed under GPLv2 or later.
Bundled qrcode-generator 2.0.4 by Kazuhiko Arase, MIT licensed.
Source: https://github.com/kazuhikoarase/qrcode-generator
The bundled js/qrcode.js is readable source; no build step is required.
Its license is included in js/LICENSE-qrcode.txt.
