Ben Treder

<p><strong>Secure Login Shield</strong> helps you lock down your WordPress login page.<br />
By default, WordPress exposes <code>/wp-login.php</code> and <code>/wp-admin/</code>. Bots hammer these URLs every day.</p>
<p>This plugin gives you a <strong>private login slug</strong> (e.g. <code>/dragon-lair</code>) and hides the default login endpoint:</p>
<ul>
<li>Defaults to <code>/wp-login.php</code> until you change it.</li>
<li>Once changed, <strong>only your custom slug</strong> works.</li>
<li>Direct access to <code>/wp-login.php</code> shows a <strong>404 Not Found</strong> (stealth mode).</li>
<li>Logged-out visitors hitting <code>/wp-admin/</code> are <strong>redirected to the homepage</strong>.</li>
<li>Deactivate the plugin <span aria-hidden="true" class="wp-exclude-emoji">→</span> everything reverts to normal.</li>
</ul>
<p>Made with ❤️ by <a href="https://BenTreder.com" rel="nofollow ugc">Ben Treder</a></p>
<h3>Features</h3>
<ul>
<li><strong>Private login slug</strong> (e.g. <code>/dragon-lair</code>, <code>/control-center</code>, <code>/secret-gate</code>)</li>
<li><strong>Stealth 404 protection</strong>: Bots hitting <code>/wp-login.php</code> see “Not Found”</li>
<li><strong>Homepage redirect</strong>: <code>/wp-admin/</code> (logged out) <span aria-hidden="true" class="wp-exclude-emoji">→</span> homepage</li>
<li><strong>Easy settings page</strong> under Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Secure Login Shield</li>
<li><strong>Safe activation/deactivation</strong>: no core hacks, auto-reverts when disabled</li>
</ul>
<h3>Contribute & Support</h3>
<ul>
<li>Website: <a href="https://BenTreder.com" rel="nofollow ugc">BenTreder.com</a>  </li>
<li>Author: <a href="https://profiles.wordpress.org/bentreder/" rel="nofollow ugc">Ben Treder</a>  </li>
<li>Issues & Feature Requests: Please open a ticket on <a href="https://BenTreder.com" rel="nofollow ugc">BenTreder.com</a>  </li>
<li>Like this plugin? ⭐ Leave a review and help spread the word!  </li>
<li>☕ Support development: <a href="https://www.buymeacoffee.com/bentreder" rel="nofollow ugc">Buy Me a Coffee</a></li>
</ul>


Secure Login Shield

Create a private login URL and hide /wp-login.php with stealth 404s. Logged-out /wp-admin/ visits redirect to your homepage.

Brendigo

<p>BrenWP Client Safe Mode helps you troubleshoot safely and reduce risk when handing a WordPress site to clients or non-technical users.</p>
<p>Safe Mode is <em>per-user</em>: it applies only to the currently logged-in user who enabled it. Visitors and other users are not affected.</p>
<h4>Safe Mode (per-user) can optionally</h4>
<ul>
<li>Block access to risky wp-admin screens (plugin/theme management, core updates, Site Health, and update actions)</li>
<li>Disable file modifications (plugin/theme installs, updates, editors)</li>
<li>Optionally block update/install capabilities (prevents running updates/installs even via alternative flows)</li>
<li>Optionally block destructive capabilities (prevents deleting plugins/themes while Safe Mode is enabled)</li>
<li>Optionally disable the built-in plugin/theme editors (capability-based) while Safe Mode is enabled</li>
<li>Hide update notices</li>
<li>Trim selected admin bar nodes (Updates / Comments / New Content)</li>
<li>Auto-disable after a configurable number of minutes (optional)</li>
</ul>
<h4>Client restrictions (role-based + optional user targeting) can</h4>
<ul>
<li>Optionally target a specific user account (in addition to roles)</li>
<li>Hide risky menus</li>
<li>Block direct access to sensitive wp-admin screens</li>
<li>Disable file modifications</li>
<li>Hide update notices</li>
<li>Optionally limit the Media Library to a user’s own uploads (privacy on multi-author sites)</li>
<li>Optionally hide common Dashboard widgets for restricted roles (UI cleanup)</li>
<li>Optionally hide the Screen Options dropdown (independent toggle)</li>
<li>Optionally hide the Admin Bar on the front end for restricted roles</li>
<li>Optionally block Customizer access (customize.php)</li>
<li>Optionally block Users screens (Users list/Add/Edit) even if the broader screen blocklist is disabled</li>
<li>Optionally block Tools screens (Tools/Import/Export) even if the broader screen blocklist is disabled</li>
<li>Optionally lock profile email/password changes for restricted roles (prevents self-service account takeover)</li>
<li>Optionally show a dismissible 2FA security reminder notice (notice only)</li>
<li>Optionally hide the Admin Bar on the front end for restricted roles</li>
</ul>
<h4>General hardening (site-wide, optional)</h4>
<ul>
<li>Disable XML-RPC</li>
<li>Disable the built-in plugin/theme editors for all users (capability-based)</li>
<li>Optional settings export download (admin-only) via a nonce-protected endpoint (default OFF)</li>
</ul>
<p>Administrators are never restricted by client restrictions. On multisite, super-admins are also excluded.</p>
<h4>Privacy</h4>
<p>This plugin does not send data to external services. It performs <strong>no tracking, telemetry, analytics, or “phone-home” requests</strong>.</p>
<h4>Data stored on your site</h4>
<p>The plugin stores the minimum required data to provide Safe Mode and optional auditing:</p>
<ul>
<li><strong>Options (Settings)</strong>: stored in the <code>brenwp_csm_options</code> option (site option). This contains your configured settings.</li>
<li><strong>Activity log (optional)</strong>: stored in the <code>brenwp_csm_activity_log</code> option <strong>only if Activity logging is enabled</strong>. This log is bounded by <strong>Max entries</strong> and can optionally be pruned by age (Retention days).</li>
<li><strong>Operational options</strong>: internal housekeeping options such as <code>brenwp_csm_last_settings_change</code> and a short-lived lock key used to avoid concurrent log writes.</li>
<li><strong>User meta (Safe Mode)</strong>:
<ul>
<li><code>brenwp_csm_safe_mode</code> (on/off flag for a user)</li>
<li><code>brenwp_csm_safe_mode_until</code> (optional expiry timestamp if auto-off is enabled)</li>
</ul>
</li>
</ul>
<h4>Data minimization and retention</h4>
<ul>
<li>Activity logging is <strong>disabled by default</strong>.</li>
<li>The activity log does <strong>not</strong> store IP addresses and attempts to redact likely secrets from context values.</li>
<li>Retention controls:
<ul>
<li><strong>Max entries</strong> caps log size.</li>
<li><strong>Retention days</strong> can automatically prune older entries (0 = disabled).</li>
<li>The <strong>Clear log</strong> action removes all log entries immediately (admin-only, nonce protected).</li>
</ul>
</li>
</ul>
<h4>Privacy tools</h4>
<p>The plugin:<br />
* Adds suggested text to the Privacy Policy Guide (Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy)<br />
* Registers a personal data exporter and eraser for the Safe Mode user meta</p>
<h4>Data deletion</h4>
<p>On uninstall (delete), the plugin removes its options, optional log option, Safe Mode user meta, and (best-effort) the optional <code>bren_client</code> role if it was created by the plugin.</p>
<h3>Security</h3>
<p>This plugin follows WordPress hardening best practices:</p>
<ul>
<li><strong>CSRF protection</strong>: all state-changing actions use <strong>POST</strong> and require a <strong>WordPress nonce</strong>.</li>
<li><strong>Authorization</strong>: privileged admin actions are gated by <strong>capability checks</strong> (<code>manage_options</code> by default, filterable).</li>
<li><strong>XSS defense</strong>: user-controlled data is sanitized on input and escaped on output.</li>
<li><strong>No remote requests</strong>: the plugin does not make outbound HTTP requests.</li>
<li><strong>Data minimization</strong>: the activity log is bounded, does not store IP addresses, and redacts likely secrets in log context values.</li>
</ul>
<p>Assumptions and scope:</p>
<ul>
<li>The plugin enforces policies inside WordPress; it does not replace server/WAF hardening.</li>
<li>Safe Mode is <strong>per-user</strong> and does not modify the site’s active plugins/themes list.</li>
</ul>
<h3>Troubleshooting</h3>
<h4>I don’t see the Safe Mode toggle in the admin bar</h4>
<ul>
<li>Confirm the WordPress admin bar is enabled for your account.</li>
<li>Confirm <strong>Enforcement</strong> is enabled in the plugin settings.</li>
<li>Confirm your role is included in <strong>Who can toggle Safe Mode</strong> (or you are an administrator / multisite super-admin).</li>
</ul>
<h4>My profile email/password cannot be changed</h4>
<p>If <strong>Restrictions <span aria-hidden="true" class="wp-exclude-emoji">→</span> Lock profile email/password</strong> is enabled and your account is restricted, you will not be able to change your own email or password. Contact an administrator.</p>
<h4>XML-RPC stopped working</h4>
<p>If you rely on legacy services that require XML-RPC (some old mobile apps / integrations), disable <strong>General <span aria-hidden="true" class="wp-exclude-emoji">→</span> Disable XML-RPC</strong>.</p>
<h4>I get redirected with an “Access blocked” notice</h4>
<p>A configured policy blocked a sensitive admin screen. Review:<br />
* <strong>Restrictions <span aria-hidden="true" class="wp-exclude-emoji">→</span> Block direct screen access</strong> (for restricted roles)<br />
* <strong>Safe Mode <span aria-hidden="true" class="wp-exclude-emoji">→</span> Block risky admin screens</strong> (for your account if Safe Mode is enabled)</p>
<h4>Safe Mode is enabled but I want to turn it off</h4>
<ul>
<li>Use the <strong>Safe Mode</strong> tab to toggle it off.</li>
<li>If auto-off is enabled, it will disable automatically after the configured time window.</li>
<li>If Enforcement is OFF, the UI provides a <strong>Clear stored Safe Mode</strong> button to remove the stored flag.</li>
</ul>
<h3>Developer Hooks</h3>
<p>Filters:<br />
* <code>brenwp_csm_required_cap</code> — change the capability required to manage this plugin (default: <code>manage_options</code>).<br />
* <code>brenwp_csm_presets</code> — customize Dashboard presets (label/description/patch arrays).<br />
* <code>brenwp_csm_create_client_role</code> — return <code>false</code> to prevent creating the <code>bren_client</code> role on activation.<br />
* <code>brenwp_csm_client_role_caps</code> — customize capabilities assigned to the <code>bren_client</code> role on activation.<br />
* <code>brenwp_csm_remove_client_role_on_uninstall</code> — return <code>false</code> to keep the <code>bren_client</code> role during uninstall cleanup.</p>


BrenWP Client Safe Mode

Per-user Safe Mode plus role-based client restrictions for safer troubleshooting and cleaner client handoff.

Secure Login Shield vs BrenWP Client Safe Mode