Dotsquares Custom Login URL & Security Suite

Dotsquares Custom Login URL & Security Suite helps secure your WordPress site by allowing you to change the default login URL and apply additional security layers — all from one beautifully designed dashboard.

🔑 Login Security

• Custom login slug — redirect wp-login.php to your own secret URL
• Optionally hide wp-login.php (returns 404 for guests)
• Optionally block wp-admin for non-logged-in users
• Brute force protection with configurable lockout thresholds
• Login honeypot trap (hidden field that catches bots)
• Two-Factor Authentication (TOTP — works with Google Authenticator, Authy, etc.)
• Weak username detection (blocks “admin”, “root”, “test”, etc.)
• Force logout after inactivity (configurable timeout)
• Manual approval for new user registrations
• Prevent display name from matching username

🛡️ Firewall

• Disable XML-RPC (common attack vector)
• Block bad bots and fake user agents (40+ known bots)
• Block POST requests with empty User-Agent headers
• Rate limiting per IP address
• IP blacklist and whitelist (supports CIDR ranges)
• Geo-blocking by country code
• Restrict REST API for non-logged-in users
• Prevent user enumeration via ?author= scans

🔍 Malware & File Scanner

• Deep scan of WordPress core, plugins, themes and uploads
• 40+ malware signature patterns (PHP shells, backdoors, crypto miners, pharma hacks, SEO spam injections)
• Detects known web shells by filename (c99, r57, WSO, b374k, adminer, etc.)
• WordPress core file integrity check (compares against official api.wordpress.org checksums)
• Detects PHP files hidden inside the uploads folder
• Suspicious code pattern detection (eval, exec, base64_decode combos, etc.)
• File change detection using MD5 hash baseline
• File permission scanner (755/644 standards)
• .htaccess security rules generator

👥 User & Session Management

• View and kill active user sessions
• Session tracking with IP and user-agent logging
• Manual user approval workflow

📊 Monitoring & Logs

• Security event log (login, logout, failed attempts, plugin/theme changes)
• IP blocking log with unblock controls
• Real-time security score (A–F grade with per-check breakdown)

⚙️ Other Features

• Maintenance mode with custom message
• Database backup download
• Email alerts for security events
• Beautiful admin dashboard with quick-toggle switches

Important

Hardening actions such as DB prefix change and wp-content rename are advanced operations.
Always run these features on a staging environment and ensure you have a full backup before applying them on production.