Zashita 24/7 Security: Custom Login URL & Core Integrity

Zashita 24/7 (Russian for “protection 24/7”) closes the most common doors bots knock on every day. The admin interface is in Russian.

Custom login URL

• Replace wp-login.php with your own address, for example example.com/in-k7m2x9pq/.
• Visitors who open wp-login.php or /wp-admin/ without being logged in get the theme’s “not found” page.
• Log out, lost password, password reset, registration and the links in WordPress emails keep working at the new address.
• Forms that use admin-ajax.php or admin-post.php, the REST API, WP-Cron and the WooCommerce account page are not affected.
• The password form of protected posts stays on wp-login.php so the new address is not shown to visitors.
• No core files or .htaccess are modified. Deactivate the plugin and wp-login.php works again.
• The new address is emailed to the site administrator when it changes.
• Lost the address? Add define( 'ZSHT_LOGIN_URL_OFF', true ); to wp-config.php, or rename the plugin folder over FTP.

Core integrity check

• Compares every file in wp-admin and wp-includes with the official checksums from WordPress.org for your version and locale.
• Lists modified, missing and unexpected files, including PHP files in the site root that are not part of WordPress.

Login log

• Successful and failed logins with date, username, IP address, browser and method (login form, XML-RPC, REST API).
• Records are deleted automatically after 7–90 days (30 by default). Suggested privacy policy text is added to the WordPress privacy guide.

Security checklist

• PHP version, file editor, public debug.log, XML-RPC, visible usernames and the login URL — what is at risk and why.

An optional paid add-on, Zashita 24/7 Pro, is available at wp-addon.ru. It adds a malware scanner, quarantine, brute-force protection, hardening and notifications. This plugin works fully on its own and contains no license checks or locked features.

External services

The core integrity check requests checksums from the WordPress.org API.

• Service: WordPress.org API (api.wordpress.org), endpoint core/checksums/1.0/.
• What is sent: the installed WordPress version and locale, as part of a standard request made by the WordPress function get_core_checksums(). No personal data and no site files are sent.
• When: only when an administrator clicks “Check core files”.
• Terms of use: https://wordpress.org/about/privacy/ (WordPress.org privacy policy, which covers API requests).

The security checklist sends one HEAD request from your server to your own site to find out whether wp-content/debug.log is publicly accessible. No third-party service is involved.