Blog Cutter Smart Security Management is a local WordPress security helper. It stays on your site: it does not phone home, load remote scripts, or use a third-party threat feed.
The plugin can:
- Show a simple math challenge to suspicious guests, rate-limited browsers, or 404 probes
- Rate-limit unique URLs per IP and log the event
- Add a math check and lockout to the login form
- Hide wp-login.php behind a secret slug (optional)
- Protect comments and user registration with a math check and honeypot
- Offer optional TOTP two-factor authentication from the user profile (authenticator app, no SaaS)
- Apply common hardening: hide the generator tag, disable XML-RPC, block user enumeration, send security headers
- Block common exploit probes in the request URI (local pattern list)
- Store security events (IP, user agent, URL) in your database for a limited time
- Run a local health checklist and let administrators revoke sessions
This plugin helps reduce automated attacks. It cannot guarantee that a site will never be compromised. Keep WordPress, themes, and plugins updated, use strong unique passwords, and take regular backups.
How to configure
- After activation, open Blog Cutter Security in the admin menu.
- Review Settings. Defaults are conservative for new installs (anonymous REST lockdown and HSTS are off).
- Optional: enable two-factor authentication on each administrator Profile.
- Optional: Magic Login — send a test email first, then enable the one-time link. Opening the link requires a confirm click so email scanners cannot sign anyone in.
- If you hide the login URL, bookmark the secret slug. Locked out? Add
define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true );to wp-config.php, or deactivate the plugin over FTP / file manager.
Privacy
When logging is enabled, the plugin stores IP addresses, user agents, requested URLs, and short event details in a table on this site. Data is not sent to the plugin author. Suggested privacy-policy text is added under Tools Privacy. Personal data export and erase callbacks are registered. Email is used only when an administrator enables magic login, login alerts, or the weekly digest.
Third-party services
None. Reverse-DNS crawler verification (optional) uses the server’s DNS resolver only.
Screenshots
The dashboard shows protection status and events from the last 24 hours.
Settings for the visitor gate, rate limiting, login shield, comments, crawlers, firewall, hardening, and two-factor authentication.
Security logs stay in your database. Filter them and export a CSV.
Magic login stays locked until an email delivery test succeeds.
The health screen runs local checks and does not contact a remote service.
Administrators can review and revoke active sessions.