外掛標籤
開發者團隊
② 後台搜尋「Neksio Login & File Security」→ 直接安裝（推薦）
原文外掛簡介
Neksio Login & File Security provides comprehensive login protection and file integrity monitoring for WordPress websites. The plugin combines two-factor authentication (2FA) with file system monitoring to help site administrators protect user accounts and detect unauthorized changes to critical WordPress files.
Key Features
Two-Factor Authentication (TOTP)
Recovery Codes
Trusted Devices
Custom Login URL
Login Rate Limiting
IP Blocking
File Integrity Monitoring
Security Dashboard
Security Event Logs
Email Notifications
Role-Based 2FA Enforcement
Emergency Access
Data Management
Login Protection
The plugin implements multiple layers of login security:
Two-Factor Authentication (TOTP) – Time-based one-time passwords compatible with Google Authenticator, Microsoft Authenticator, Authy, 1Password, and Bitwarden
Recovery Codes – Backup access codes generated when 2FA is enabled, stored as secure hashes
Trusted Devices – Remember authenticated browsers for 30 days with secure, HttpOnly cookies
Custom Login URL – Replace the default wp-login.php path with a custom slug
Rate Limiting – Configurable limits on login attempts with automatic lockout
IP Blocking – Manual and automatic blocking of suspicious IP addresses
File Integrity Monitoring
The Integrity Monitor tracks changes to critical WordPress files:
Critical File Protection – Monitor wp-config.php and .htaccess for unauthorized modifications
Unknown File Detection – Identify suspicious PHP files in the WordPress root directory
Backup File Detection – Find exposed .htaccess backup files (.htaccess.bak, .htaccess.old)
Permission Monitoring – Track file permission changes that may indicate compromise
Real-Time Activity Log – View security events with timestamps and details
Security Dashboard
A centralized dashboard provides visibility into site security:
Security score calculation based on configured protections
Login activity tracking (successful and failed attempts)
Blocked IP addresses and attack classification
Security event history with filtering
Trusted devices inventory
Top threats overview
Email Notifications
The plugin sends automated email notifications for critical security events:
Recovery Codes Email:
* Sent when you request to email your recovery codes
* Contains all recovery codes in HTML format
* Automatically deletes temporary storage after sending
Security Alert Emails:
Sent when critical file changes are detected:
* wp-config.php modifications
* .htaccess modifications
* Unknown PHP files in root directory
* Dangerous file permission changes
IP Block Notifications:
Sent when an IP address is blocked:
* Brute force attacks
* Username enumeration attempts
* XML-RPC attacks
* URL scanning attempts
* Includes GeoIP data (country, city, device info)
2FA Setup Notifications:
Confirmation emails when:
* 2FA is enabled for an account
* 2FA is disabled for an account
* Recovery codes are regenerated
* Recovery Code Used (when a user successfully authenticates using a backup code)
Administrative Alerts:
Sent when critical security configurations change:
* Login URL Changed (when the custom login path is updated)
* Emergency Bypass (when the administrator uses the emergency fallback URL)
Failed Login Alerts:
* Optional notifications for failed login attempts
* Configurable threshold settings
Email Features:
* Email template customization
* Test email functionality
* Configurable notification recipients
* Rate limiting to prevent email flooding (1 email per IP/hour)
* Daily limit of 5 security alert emails
* HTML formatted emails with dashboard links
* All emails sent from your WordPress installation (no external services)
Settings Documentation
The plugin provides a unified settings interface for managing security configurations:
Enable GeoIP Lookup – Controls optional IP intelligence and geolocation data for security reports.
Enable Tor Exit Node Detection – Controls optional detection of known Tor exit nodes during login attempts.
Email Notifications – Customize recipients, enable/disable specific alerts, and manage notification thresholds.
Trusted Devices – Configure expiration durations for remembered browsers and manage trusted device tokens.
Custom Login URL – Configure a custom path to hide the default WordPress login page, including emergency bypass options.
File Integrity Monitoring – Configure settings for monitoring critical files and directory changes.
Security Philosophy
Neksio Login & File Security follows WordPress coding standards and uses WordPress APIs whenever possible.
The plugin is designed to reduce attack surface while remaining compatible with standard WordPress installations.
It does not modify WordPress core files.
Data Storage
Plugin data remains inside your own WordPress installation.
Sensitive authentication data is encrypted before storage whenever applicable.
Local QR Generation
QR Codes are generated entirely on your own server.
No QR data is transmitted to external QR code services.
Developer Friendly
Uses WordPress APIs
Uses hooks and filters
Translation ready
WordPress coding standards
PHP 7.4+
GPL compatible
Accessibility
The plugin follows WordPress admin interface conventions wherever possible.
Logging
Security events are stored locally inside the WordPress database.
Retention periods are configurable.
Clean Uninstall
The plugin provides options to remove stored data during uninstall.
Compatibility
WordPress 6.0+
PHP 7.4+
PHP 8.x Ready (tested with PHP 7.4 through 8.3+)
Works with most caching plugins
Compatible with modern TOTP authenticator applications
Additional Features
Role-Based 2FA Enforcement – Require 2FA for specific user roles with configurable grace periods
Email Notifications – Receive alerts for security events, failed logins, and IP blocks
IP Intelligence – View attack patterns, geolocation data, and request counts for blocked IPs
Data Management – Configurable retention periods for logs and automatic cleanup
Emergency Access – Secret fallback URL and emergency access key for administrator recovery
Built for Real-World Use
This plugin was developed based on lessons learned from investigating and recovering a production WordPress website affected by unauthorized file modifications. The features address specific challenges encountered during incident response, including detecting modified configuration files, identifying injected files, and restoring trusted states.
Technical Details
Uses only WordPress APIs and hooks – no core file modifications
All QR codes generated locally (no external API calls)
TOTP secrets encrypted at rest
Recovery codes stored as hashes only
PHP 7.4+ required, optimized for PHP 8.1+
External services
This plugin uses or connects to the following external services:
NeksioTool Assets & IP Intelligence (neksiotool.com)
What it is and what it is used for: This plugin may connect to NeksioTool (neksiotool.com) to load custom site logos and brand images used on 2FA verification pages and plugin settings previews. It may also provide optional links to NeksioTool IP lookup tools from the IP Management dashboard.
What data is sent and when: When an external NeksioTool logo or brand image is loaded, the user’s browser may send a standard HTTP request to NeksioTool. This request may include the browser’s IP address and HTTP user-agent as part of normal web communication. When an administrator chooses to open an external NeksioTool IP lookup link, the browser also sends a standard HTTP request to that service. The plugin does not send passwords, authentication secrets, recovery codes, or other WordPress login credentials to NeksioTool.
Service Terms & Privacy Policy:
Terms of Service: https://neksiotool.com/terms-of-service/
Privacy Policy: https://neksiotool.com/privacy-policy/
GeoIP Geolocation Service (ip-api.com)
What it is and what it is used for: The plugin can fetch country and city geolocation data for blocked IP addresses to display in security activity logs and IP management reports.
What data is sent and when: Only the specific IP address being queried is sent via an HTTP GET request to ip-api.com. This feature is OPTIONAL and DISABLED by default; it only executes if the site administrator explicitly enables “Enable GeoIP Lookup” in security settings.
Service Terms & Privacy Policy:
Terms of Service: https://ip-api.com/docs/legal
Privacy Policy: https://ip-api.com/privacy
Tor Exit Node Detection (Tor Project)
What it is and what it is used for: The plugin can check whether incoming login requests originate from known Tor exit nodes to prevent brute-force attacks.
What data is sent and when: An HTTP GET request is sent to check.torproject.org to fetch the public exit node list. No user data, site data, or IP addresses are sent to the Tor Project. This feature is OPTIONAL and DISABLED by default; list downloads are cached locally.
Service Terms & Privacy Policy:
Terms of Service: https://support.torproject.org/
Privacy Policy: https://torproject.org/about/privacy_policy/
QR Code Generation
QR codes for 2FA setup are generated 100% locally using bundled libraries (chillerlan/php-qrcode or qrcodejs). No data is sent to any external server for QR code generation.
Privacy Policy
Neksio Login & File Security stores data locally in your WordPress database.
Data Stored
User Meta: 2FA status, encrypted TOTP secrets, last verification timestamp, recovery status
Custom Tables: Recovery code hashes, trusted device information, login logs, security events, IP blacklist, file backups
Options: Plugin settings, custom login URLs, security codes
Cookies
The plugin uses one cookie for trusted device management:
Name: nlfs_trusted_device
Duration: 30 days
Attributes: Secure, HttpOnly, SameSite=Lax
Data Retention
Configurable retention periods for:
Login logs
Security events
Trusted devices (automatic cleanup after inactivity)
IP blacklist records
File backups
Data Removal
All plugin data can be deleted through the Uninstall settings page or by uninstalling the plugin with data removal enabled. Individual users can delete their 2FA data from their profile page.
Third-Party Services
This plugin does not automatically transmit data to external servers except under the following conditions:
IP Intelligence Reports: Links open in a new tab only when explicitly clicked by the user. The plugin does not automatically send any data to these services.
GeoIP Lookup: This feature is DISABLED by default. It requires explicit user opt-in via the plugin settings (“Enable GeoIP Lookup”). The plugin will NOT send any IP addresses to external servers unless the administrator actively enables this option. When enabled, it uses ip-api.com to obtain geolocation data (country/city) for blocked IPs.
QR code generation is performed 100% locally with no external API calls.
Email notifications are sent from your WordPress installation using wp_mail(). No external email services are used.
Access to Data
Only users with appropriate capabilities can access administrative data. Users can access only their own 2FA settings and recovery codes.
Data Encryption
TOTP secrets are encrypted at rest. Recovery codes are stored as hashes only.
Support
Documentation: https://www.neksiotool.com/neksio-login-file-security/
WordPress.org forums: https://wordpress.org/support/plugin/neksio-login-file-security/
Email: [email protected]
Website: https://www.neksiotool.com
Credits
QR Code Generation (PHP 8.1+): chillerlan/php-qrcode – https://github.com/chillerlan/php-qrcode
QR Code Generation (PHP < 8.1): qrcodejs by davidshimjs – https://github.com/davidshimjs/qrcodejs
Icons: WordPress Dashicons
GeoIP Service: ip-api.com – https://ip-api.com
Tor Exit Node List: The Tor Project – https://www.torproject.org/
License
Neksio Login & File Security is licensed under the GNU General Public License v2 or later.
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
