Fixes a lockout that blocked administrators from wp-admin and broke all AJAX when a custom login URL was set, and drops a default CSP that broke inline scripts and styles. Adds brute-force protection and emergency login recovery. Settings migrate automatically. Needs PHP 7.2.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3304050,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.jpg":{"filename":"banner-1544x500.jpg","revision":3312453,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.jpg":{"filename":"banner-772x250.jpg","revision":3312453,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0","1.1","2.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Login Protection \u2014 custom slug, block behaviour, emergency access and active lockouts.","2":"Security Headers \u2014 per-header toggles with validation and recommended values.","3":"SSL \u2014 HTTPS enforcement with proxy-aware detection."}},"plugin_section":[],"plugin_tags":[2439,25642,602,600,153786],"plugin_category":[38,54],"plugin_contributors":[243208],"plugin_business_model":[],"class_list":["post-233266","plugin","type-plugin","status-publish","hentry","plugin_tags-brute-force","plugin_tags-hide-login","plugin_tags-login","plugin_tags-security","plugin_tags-security-headers","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-junaid434","plugin_committers-junaid434"],"banners":{"banner":"https:\/\/ps.w.org\/wps-protect-login-url-security-headers\/assets\/banner-772x250.jpg?rev=3312453","banner_2x":"https:\/\/ps.w.org\/wps-protect-login-url-security-headers\/assets\/banner-1544x500.jpg?rev=3312453","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/wps-protect-login-url-security-headers\/assets\/icon-256x256.png?rev=3304050","icon_2x":"https:\/\/ps.w.org\/wps-protect-login-url-security-headers\/assets\/icon-256x256.png?rev=3304050","generated":false},"screenshots":[],"raw_content":"\n
WPS Protect<\/strong> combines the three defences most WordPress sites install three separate plugins for \u2014 a hidden login URL, brute-force rate limiting, and HTTP security headers \u2014 into one lightweight plugin with no upsells and no performance overhead.<\/p>\n\n Losing your login URL should never mean editing the database. Three independent recovery routes:<\/p>\n\n The site administrator is emailed whenever the rescue URL is used.<\/p>\n\n Activation does not change your login URL. Nothing moves until you set a slug yourself, and the plugin issues a rescue URL at that moment.<\/p>\n\n\n Use the rescue URL shown when you saved the slug. If you no longer have it, add Login and REST requests are never cached, so brute-force protection and the login gate are unaffected. Security headers are sent by PHP, so on a page served from a full-page cache they may be served by your cache layer instead. If your host serves cached pages without invoking PHP, set the headers at the server level too.<\/p><\/dd>\n Yes, but configure your proxy ranges under the brute-force settings first. Until you do, the plugin deliberately declines to block by IP address rather than risk locking out every visitor sharing a proxy address.<\/p><\/dd>\n Enable \"do not overwrite headers already set\" if something else is already sending headers. Running two plugins that both hide the login URL is not supported \u2014 pick one.<\/p><\/dd>\n Your settings are migrated automatically, including your login slug, HTTPS setting and any header values you saved. One thing intentionally does not carry over: 1.x applied a hard-coded Complete architectural rewrite, plus WordPress 7.1 compatibility.<\/p>\n\n Fixed (critical)<\/strong><\/p>\n\n Added<\/strong><\/p>\n\n Changed<\/strong><\/p>\n\n Compatibility<\/strong><\/p>\n\nLogin URL protection<\/h4>\n\n
\n
wp-login.php<\/code> to a slug of your choice.<\/li>\n\/wp-admin\/<\/code> are sent to your login page with their destination preserved, instead of hitting a dead end.<\/li>\nadmin-post.php<\/code> and REST endpoints stay reachable, so front-end forms, carts and the block editor keep working.<\/li>\nEmergency access<\/h4>\n\n
\n
define( 'WPSP_DISABLE_LOGIN_GATE', true );<\/code> in wp-config.php<\/code>.<\/li>\nwp wpsp login-url<\/code>, wp wpsp set-slug<\/code>, wp wpsp disable-gate<\/code>.<\/li>\n<\/ol>\n\nBrute-force protection<\/h4>\n\n
\n
system.multicall<\/code> is disabled, closing the XML-RPC amplification trick that turns one request into hundreds of password guesses.<\/li>\n429<\/code> with Retry-After<\/code>, so Cloudflare, Fastly or fail2ban can shed the attack at the edge.<\/li>\n<\/ul>\n\nSecurity headers<\/h4>\n\n
\n
HTTPS enforcement<\/h4>\n\n
\n
307<\/code>, so no data is lost.<\/li>\n\n
\/wp-content\/plugins\/wps-protect-login-url-security-headers\/<\/code>, or install through the Plugins screen.<\/li>\n\n
What happens if I forget my login URL?<\/h3><\/dt>\n
define( 'WPSP_DISABLE_LOGIN_GATE', true );<\/code> to wp-config.php<\/code>, or run wp wpsp login-url<\/code> over WP-CLI. Deactivating the plugin also restores wp-login.php<\/code>, and your settings survive deactivation.<\/p><\/dd>\nWill this break my caching plugin?<\/h3><\/dt>\n
Does it work behind Cloudflare?<\/h3><\/dt>\n
Will it conflict with another security plugin?<\/h3><\/dt>\n
I upgraded from 1.x. What changed for me?<\/h3><\/dt>\n
Content-Security-Policy: default-src 'self'<\/code> whenever you had not set one, which blocked inline scripts and styles on most sites. That fallback is gone. If you want a CSP, set one explicitly on the Security Headers tab.<\/p><\/dd>\n\n<\/dl>\n\n\n2.0.0<\/h4>\n\n
\n
\/wp-admin\/<\/code> whenever a custom login URL was set. The capability check that guarded the dashboard was inverted: signed-in administrators were blocked while lower-privileged users were let through.<\/li>\nadmin-ajax.php<\/code> request returned 404 with a custom login URL set, breaking the block editor, media uploads, WooCommerce and any plugin using AJAX.<\/li>\nContent-Security-Policy: default-src 'self'<\/code> was applied to every site that had not visited the settings screen, blocking inline scripts and styles used by WordPress core, most themes and most plugins.<\/li>\nAccess-Control-Allow-Origin: *<\/code> is no longer sent by default.<\/li>\nHost<\/code> request header, allowing an open redirect, and issued it as a permanently cached 301<\/code>.<\/li>\nwp-admin<\/code> or wp-login.php<\/code> \u2014 including ordinary posts and uploads \u2014 returned 404.<\/li>\nexit<\/code> inside the wp_logout<\/code> action aborted password resets and any programmatic logout.<\/li>\naction=postpass<\/code>) no longer return 404.<\/li>\n\n
429<\/code> with Retry-After<\/code>. Covers the login form, XML-RPC, REST, Application Passwords, WooCommerce and BuddyPress.<\/li>\nwp-config.php<\/code> constant, and WP-CLI commands.<\/li>\nwp wpsp login-url<\/code>, set-slug<\/code>, disable-gate<\/code>, rescue<\/code>, unlock<\/code>, lockouts<\/code>, audit<\/code>.<\/li>\n\n
src\/<\/code>, separated into Login, Headers, SSL, Brute-force, Admin, Support, CLI and Compat modules.<\/li>\nadmin-post.php<\/code> with capability checks, nonce verification and a POST\/Redirect\/GET cycle, so refreshing no longer resubmits.<\/li>\nX-XSS-Protection<\/code> now defaults to 0<\/code>, matching current OWASP guidance. The previous 1; mode=block<\/code> enabled a deprecated browser filter with vulnerabilities of its own.<\/li>\n%i<\/code> identifier placeholder in $wpdb->prepare()<\/code>, which the brute-force log uses to quote table names.<\/li>\n<\/ul>\n\n\n
@wordpress\/components<\/code>, jQuery UI 1.14.2 and client-side media processing changes do not apply to it. Applying security headers across wp-admin<\/code> is a separate, off-by-default option, because a restrictive Content-Security-Policy can interfere with the now always-iframed editor.<\/li>\nwpsplu_options<\/code> record, the wpsplu<\/code> admin page slug and its tab URLs are all preserved. Removed 1.x functions remain declared as no-op shims that raise a deprecation notice rather than a fatal error.<\/li>\n<\/ul>\n\n1.1<\/h4>\n\n
\n
1.0<\/h4>\n\n
\n