KHALAF Login Access Guard

KHALAF Login Access Guard defends your WordPress website against automated bots, brute-force attacks, and credential stuffing by transforming the standard /wp-login.php path into a private, customizable URL of your choice.

Unlike typical hide-login plugins that simply display a generic 404 error or a blank screen, KHALAF Login Access Guard provides a dedicated visual customizer and a real-time live preview inside your dashboard to design a modern, branded 403 Access Denied page for blocked visitors.

Key Features

• Custom Secret Login URL: Move /wp-login.php to any custom slug (e.g. /my-secret-door).
• Visual Access Denied Customizer: Full control over background gradients/colors, card border radius, shadows, padding, icons, typography, and button styling.
• Interactive Live Preview: Preview your custom 403 Forbidden page in real time directly from the admin settings before publishing.
• Dual-Language & RTL Ready: Native support for Arabic and English with seamless RTL (right-to-left) typography and layout switching.
• XML-RPC Attack Defense: Optional toggle to block automated attacks targeting xmlrpc.php.
• Zero Disruption to Core Actions: Password recovery links with secure reset tokens, logout, privacy confirmations, and protected post actions continue working seamlessly.
• Safe Redirect Option: Option to redirect unauthorized attempts to any custom URL on your domain instead of rendering the denied page.
• One-Click Toggle: Activate or deactivate protection anytime without losing your customized design or settings.
• Cryptographic Slug Generator: Generate secure, randomized login slugs using browser cryptographic randomness with one click.
• Non-Intrusive Admin Notices: Dismissible dashboard reminders compliant with WordPress Guidelines.

Security Notes

• The plugin does not alter the WordPress admin dashboard (/wp-admin). Once logged in, administrators and authors work normally.
• Hiding your login URL provides a strong layer of defense against automated scanning bots, but should be combined with strong passwords and 2FA.
• The redirect option restricts destination targets to the same site domain to eliminate open-redirect vulnerabilities.
• Reserved system slugs (wp-admin, admin, login, xmlrpc, wp-json, etc.) are blocked from being set as the login slug.
• All settings and requests are sanitized, validated, and escaped following WordPress coding standards.