Currently under review on WordPress.org. Download the .zip directly from GitHub to install it now.
How to Install in WordPress
Click the Download Plugin button above to get the latest .zip file.
Go to your WordPress Dashboard → Plugins → Add New Plugin.
Click Upload Plugin at the top, choose the downloaded .zip file, and click "Install Now".
Activate the plugin.
Configure: Go to Settings → Login Guard to set your secret URL and security options.
Bookmark your new Secret Entry URL immediately — you'll need it to log in.
Optional: If you hit a 404 on first use, go to Settings → Permalinks and click Save Changes.
Jacker Login Guard Features
Why Choose This Plugin?
Built from the ground up to solve real security problems without slowing down your site.
Hidden Entry URL
Hides wp-login.php and wp-admin from public view. Only your secret slug is reachable.
Signed Access Tokens
HMAC-SHA256 signed, 5-minute cookies. Even if someone guesses your URL, they can't reach the login form without a valid token.
Cloudflare Aware
Securely detects real visitor IPs behind Cloudflare. Cloudflare headers are only trusted when the request originates from an official Cloudflare IP range. Full IPv4/IPv6 & CIDR support.
Zero Bloat
No heavy JavaScript on the frontend. External API calls are limited to admin-side geo lookups and a 7-day cached Cloudflare IP refresh — never on public page views.
Passkey & 2FA Friendly
Unlike older plugins that break modern auth, our architecture ensures WordPress 6.3+ Passkeys and popular 2FA plugins work flawlessly.
Smart Blocking
Returns 0.0.0.0, 404, or 403 to unauthorized scanners — hiding your site's existence and wasting their resources.
Auto-Block & Escalation
Suspicious IPs are auto-blocked after a configurable number of attacks, expire automatically, and repeat offenders escalate to the permanent blacklist.
Trusted IP Window
After a successful login, the same IP is protected from auto-blocking for a configurable window — so you never lock yourself out.
Three Logging Systems
Login Events, Access Log (with referer + status filter), and Auto Block List. Plus an admin operation audit with 15-minute deduplication.
Live Preview
Clean & Intuitive Admin Interface
No bloated menus. Six clean tabs: Dashboard, Settings, Login Events, Current Login, Access Log, and Auto Block List.
Jacker Login Guard
Dashboard
Real-time statistics. Sample data for demonstration.
Last Login
2026-09-03 08:24:15
Admin Online
1
All Online Users
3
Total Sessions
12
Blocked (24h)
47
Total Blocked
1,284
Auto-Blocked IPs
8
Hidden Entry URL:https://example.com/my-login/
Note: If you encounter a 404 error on first use, please visit Settings > Permalinks and click "Save Changes".
Login Slug
Single URL slug (lowercase letters, numbers, hyphens). Example: my-login
Login Protection Mode
Unauthorized Response
Whitelist IPs
One IP or CIDR range per line. IPv4 (0–32), IPv6 (0–128). Inline comments after # are allowed.
Whitelisted IPs bypass ALL protection rules and are never blocked.
Blacklist IPs
Same format as Whitelist. Blacklist always takes priority over Whitelist.
API Whitelist
One endpoint per line. Paths starting with /wp-json/.
Path Whitelist
One path per line. Paths must start with /.
Log Retention Limit
Recommended: 300 entries per log table. Range: 10–5000.
Session Lifetime
minutes
Auto-logout after inactivity. 0 = WordPress default (2 days). Max 10080 (7 days).
Auto-Block Trigger
attacks
An IP is blocked only after this many attack attempts. Recommended: 3.
Auto-Block Duration
hours
How long a block lasts before the IP is automatically unblocked. Max 8760 (1 year).
Auto-Block Escalation
times
After this many block cycles, the IP is added to the permanent Blacklist. Set to 0 to disable.
Trusted IP Window
days
After a successful login, the same IP is protected from auto-blocking for this many days. Set to 0 to disable.
Security Options
Advanced Options
Danger Zone
Reset all plugin settings to their default values.
Data Retention on Plugin Deletion
Import / Export
Login Events — Last 300 Entries (5 total) · sample data
ID
Username
Time
IP
Status
Actions
5
admin
2026-09-03 08:24:15
192.0.2.1 🇺🇸
✅ Success
4
editor
2026-09-02 16:21:11
198.51.100.45 🇬🇧
✅ Success
3
root
2026-09-01 22:45:03
203.0.113.78 🇷🇺
❌ Failed
2
admin
2026-08-31 12:39:23
192.0.2.52 🇺🇸
❌ Failed
1
admin
2026-08-31 10:48:29
198.51.100.52 🇬🇧
✅ Success
5 items
1
Current Login — 3 online sessions · sample data
Shows users active within the last 30 minutes. Auto-refreshes every 5 minutes.
#
Username
Display Name
Role
IP
Last Activity
Status
Actions
1
admin
Site Administrator
administrator
192.0.2.1 🇺🇸
12s ago
🟢 Online
2
editor
Jane Editor
editor
198.51.100.45 🇬🇧
3m 12s ago
🟢 Online
3
author1
John Author
author
203.0.113.78 🇷🇺
18m 4s ago
🟡 Away
Access Log — Last 300 Entries · sample data
Records access attempts to sensitive resources: login, wp-admin, REST API, XML-RPC, and config files.
Note: An IP is automatically blocked after 3 attack attempts.
Admin operation: POST options-general.php (user #1, save)
✅ Allowed
Auto Block List — Last 300 Entries (3 active) · sample data
Remove = unblock (unless on manual blacklist).
Note: Auto-blocks expire automatically after 24 hours. An IP that is auto-blocked 3 times is escalated to the permanent Blacklist.
#
IP
Reason
Blocked At
Expires At
Actions
3
203.0.113.78 🇷🇺
Direct login access attempt
2026-09-03 09:14:02
2026-09-04 09:14:02
2
198.51.100.201 🌐
User enumeration attempt
2026-09-03 07:52:11
2026-09-04 07:52:11
1
203.0.113.55 🇷🇺
Sensitive file access attempt
2026-09-02 23:08:45
2026-09-03 23:08:45
Note: All data above is sample data for demonstration purposes. Your actual logs will appear here after activation.
A preview of the actual Jacker Login Guard settings page inside WordPress.
The Story
Why I Built This Plugin
This plugin was born from frustration. My site was repeatedly targeted:
hackers kept resetting admin passwords, escalated to mass-creating fake admin accounts,
and finally installed a malicious backdoor plugin to steal data.
I needed something lightweight,
effective, and modern —
that respects Core Web Vitals and works seamlessly with WordPress 6.3+ Passkeys.
Existing solutions were either too heavy or broke modern authentication features.
So I built it myself. No tracking, no upsells, no bloat. Just pure, lightweight security
that does one thing exceptionally well: protecting your login page.
Jacker Architect
Independent Developer & Security Enthusiast
FAQ
Frequently Asked Questions
What happens if I forget my Secret Entry URL?
If you have access to your hosting file manager or FTP, rename the plugin folder (e.g., to jacker-login-guard-disabled) to temporarily disable it, then log in via the standard wp-login.php. Once logged in, reactivate the plugin and check the settings.
Does this plugin support Passkeys and 2FA?
Yes. Our signed cookie mechanism is designed to be fully compatible with WordPress 6.3+ Passkeys and popular 2FA plugins. It does not interfere with the authentication flow.
Will this slow down my website?
No. The plugin uses extremely lightweight PHP hooks and object caching. It does not load any heavy scripts or stylesheets on your frontend pages.
Does this plugin support multisite?
Yes. However, settings are managed per-site, not network-wide.
How does the Attack Detection work?
The plugin automatically detects suspicious User-Agent strings, empty or short User-Agents, encoded malicious content (SQL injection, XSS, command injection), invalid request methods, and high-frequency requests (120+ per minute). Detected attacks are counted. After the configured number of attempts, the IP is auto-blocked.
How does auto-unblock work?
Auto-blocks expire after the configured duration. Once expired, the IP is automatically unbanned.
How does escalation work?
Every auto-block cycle is counted. When the count reaches the configured threshold, the IP is added to the permanent blacklist, which never expires unless manually removed.
What is the Trusted IP Window?
After a successful login, the same IP is protected from auto-blocking for a configurable number of days. This prevents the admin from accidentally blocking themselves when their session expires.
What is the API Whitelist for?
By default, all REST API endpoints are blocked. If you use plugins like Jetpack, WooCommerce, or custom APIs, add their endpoint paths to the whitelist. Example: /wp-json/jetpack/v4/, /wp-json/woocommerce/v1/.
What is the Access Log?
The Access Log records requests to sensitive resources: login page attempts (allowed and blocked), wp-admin access attempts, REST API calls (whitelisted endpoints), XML-RPC requests, and configuration file access attempts. Each entry shows the target path, the referer, and whether it was allowed or blocked. Normal page views (homepage, posts, categories) are NOT logged.
Which IP formats are supported?
Whitelist and Blacklist accept one entry per line:
Single IPv4 — 192.168.1.100
Single IPv6 — 2001:db8::1
IPv4 CIDR — 192.168.1.0/24
IPv6 CIDR — 2001:db8::/32
IPv4 range — 192.168.1.10-192.168.1.50
IPv6 range — 2001:db8::1-2001:db8::ffff
Inline comment — 192.168.1.100 # My Office
Coming Soon
Pro Version (In Development)
Based on user feedback, I'm working on advanced features for those who need
enterprise-grade login protection.
Smart Auto-Ban
Automatically block IPs after X failed login attempts. Set custom thresholds and ban durations.
Forced 2FA / Passkey
Disable password login for Administrators entirely. Force biometric or TOTP authentication only.
Country Blocking
Block login attempts from specific countries using GeoIP. Perfect for region-specific businesses.
Real-time Alerts
Email notifications for suspicious login attempts, failed authentications, and security events.
Emergency Recovery
Master recovery system with one-time emergency access tokens for locked-out administrators.
Want to influence Pro development?
Your feedback shapes the roadmap.
This plugin is built, maintained, and supported by an independent developer.
There are no premium upsells, no tracking, and no bloat.
If this plugin has saved your website from attacks or saved you hours of debugging,
consider buying me a coffee to keep the development going!
