Nazmul Hasan Robin

<p>Keep your WordPress site safe with minimal effort. NHR Secure helps you:</p>
<ul>
<li>Hide or protect your admin area from unauthorized access.</li>
<li>Limit login attempts to prevent brute-force attacks.</li>
<li>Hide debug logs to prevent sensitive information disclosure.</li>
<li>Add 2FA to your WordPress site.</li>
<li>Scan core files, plugins, and themes for known vulnerabilities.</li>
<li>Monitor site health with one-click security recommendations.</li>
<li>Protect against SQL injection, XSS, and LFI attacks.</li>
<li>Block malicious IPs and entire countries.</li>
</ul>
<h3><strong>Features at a glance:</strong></h3>
<h3>🔒 Limit Login Attempts</h3>
<p>Stop brute-force attacks by temporarily blocking IPs after repeated failed login attempts.<br />
– Configurable attempt limit (1-20, default: 5)<br />
– Blocks based on IP + Username combination<br />
– Auto-unblock after 2 hours</p>
<h3>🔐 Custom Login Page</h3>
<p>Hide wp-login.php and use a custom login URL.<br />
– Default custom URL: <code>/hidden-access-52w</code><br />
– Blocks direct access to wp-login.php and wp-admin for guests</p>
<h3>🛡️ Protect Debug Log File</h3>
<p>Blocks direct access to <code>/wp-content/debug.log</code><br />
– Returns 403 Forbidden for all users</p>
<h3>⚙️ Modern Settings Page</h3>
<p>Configure everything from a beautiful React-powered interface.<br />
– Located under <strong>Tools <span aria-hidden="true" class="wp-exclude-emoji">→</span> NHR Secure</strong><br />
– <strong>Dark Mode</strong> support for comfortable viewing<br />
– Enable/disable each feature</p>
<h3>🔐 Two-Factor Authentication (2FA)</h3>
<p>Enable two-factor authentication for users.<br />
– Support for <strong>Authenticator Apps</strong> and <strong>Email OTP</strong><br />
– <strong>Enforce 2FA</strong> for specific user roles (e.g., Administrators)<br />
– <strong>Recovery Codes</strong> for emergency access<br />
– QR code setup for Authenticator Apps</p>
<h3>🛡️ Vulnerability Checker</h3>
<p>Automatically scan your installed plugins, themes, and WordPress core against a known vulnerability database.<br />
– Daily automatic scans<br />
– Alerts for critical security issues<br />
– Check file integrity</p>
<h3>🖥️ User Session Management</h3>
<p>Monitor and control active user sessions to prevent unauthorized access.<br />
– <strong>View Active Sessions:</strong> See IP, location, device, and login time for all logged-in users.<br />
– <strong>Remote Logout:</strong> Instantly log out suspicious sessions or all other devices.<br />
– <strong>Idle Timeout:</strong> Automatically log out inactive users after a set period.</p>
<h3>🧱 Hardening & Firewall</h3>
<p>Essential security hardening to lock down your WordPress site.<br />
– <strong>Disable XML-RPC:</strong> Prevent remote attacks and brute-force attempts.<br />
– <strong>Disable File Editor:</strong> Stop file modifications from the dashboard.<br />
– <strong>Hide WP Version:</strong> Obscure your WordPress version from attackers.<br />
– <strong>Block User-Agents:</strong> Prevent bad bots and scrapers from accessing your site.<br />
– <strong>Disable User Enumeration:</strong> Stop attackers from harvesting usernames via REST API.</p>
<h3>📝 Activity Audit Log</h3>
<p>Keep a record of important security events on your site.<br />
– Tracks logins, failed attempts, file changes, and settings updates.<br />
– View user, IP, and event details.<br />
– Configurable log retention policy.</p>
<h3>🏥 Security Health Check & One-Click Secure</h3>
<p>Get an instant overview of your site’s security posture.<br />
– <strong>Security Score:</strong> View your overall protection percentage and grade (A+ to F).<br />
– <strong>Health Dashboard:</strong> See which security features are active and which need attention.<br />
– <strong>One-Click Secure:</strong> Apply recommended security settings instantly.<br />
– <strong>11 Security Checks:</strong> Comprehensive analysis of your security status.</p>
<h3>🛡️ Advanced Firewall (IPS)</h3>
<p>Proactive intrusion prevention system that blocks malicious requests in real-time.<br />
– <strong>SQL Injection Protection:</strong> Detect and block SQLi attacks automatically.<br />
– <strong>XSS Prevention:</strong> Stop cross-site scripting attempts.<br />
– <strong>LFI Protection:</strong> Prevent local file inclusion attacks.<br />
– <strong>Pattern Matching:</strong> Advanced regex-based detection for common attack vectors.<br />
– <strong>Automatic Blocking:</strong> Suspicious requests are blocked before they reach WordPress.</p>
<h3>🌍 IP & Country Management</h3>
<p>Control access to your site with granular IP and geographic filtering.<br />
– <strong>IP Whitelist:</strong> Allow trusted IPs to bypass all security filters.<br />
– <strong>IP Blacklist:</strong> Block malicious IPs permanently from your site.<br />
– <strong>CIDR Support:</strong> Use CIDR notation for blocking entire IP ranges (e.g., 192.168.1.0/24).<br />
– <strong>Country Blocking:</strong> Block access from 90+ countries using GeoIP lookup.<br />
– <strong>Smart Caching:</strong> GeoIP lookups are cached for 24 hours for optimal performance.<br />
– <strong>Private IP Detection:</strong> Automatically skip local/private IPs.</p>
<h3>⚡ Lightweight & Minimal</h3>
<p>Designed to deliver maximum security with minimal code. No bloat, no complexity.<br />
– Compatible with most WordPress themes and plugins.</p>
<h3>External Services</h3>
<p>This plugin utilizes the <a href="https://wpvulnerability.com/" rel="nofollow ugc">WPVulnerability</a> API to check for vulnerabilities.<br />
– <strong>Service:</strong> WPVulnerability<br />
– <strong>Data:</strong> Only plugin slugs and versions are sent. No personal data is collected.</p>


NHR Secure – Login Security, Firewall, 2FA & Audit Log

A lightweight WordPress security plugin to protect your admin area with a custom login URL, hide debug logs, limit login attempts, and add 2FA.

Jason White

<p>You want to stop users from accessing the wp-admin of your WordPress installation.</p>
<p>Obfoscate WordPress admin url and prevent casual discovery. Returns 404 status from direct requests to /wp-admin on non-whitelisted host</p>
<h3>History</h3>
<p>1.0 Original Version</p>
<p>1.0.1 – added obfuscation protection for /wp-login.php – this was also casually discoverable in previous version</p>


Obfuscate Admin

You want to stop users from accessing the wp-admin of your WordPress installation. Obfoscate WordPress admin url and prevent casual discovery.

NHR Secure – Login Security, Firewall, 2FA & Audit Log vs Obfuscate Admin