About this plugin
Blog Cutter Smart Security Management is a local WordPress security helper. It stays on your site: it does not phone home, load remote scripts, or use a third-party threat feed.
The plugin can:
- Show a simple math challenge to suspicious guests, rate-limited browsers, or 404 probes
- Rate-limit unique URLs per IP and log the event
- Add a math check and lockout to the login form
- Hide wp-login.php behind a secret slug (optional)
- Protect comments and user registration with a math check and honeypot
- Offer optional TOTP two-factor authentication from the user profile (authenticator app, no SaaS)
- Apply common hardening: hide the generator tag, disable XML-RPC, block user enumeration, send security headers
- Block common exploit probes in the request URI (local pattern list)
- Store security events (IP, user agent, URL) in your database for a limited time
- Run a local health checklist and let administrators revoke sessions
This plugin helps reduce automated attacks. It cannot guarantee that a site will never be compromised. Keep WordPress, themes, and plugins updated, use strong unique passwords, and take regular backups.
How to configure
- After activation, open Blog Cutter Security in the admin menu.
- Review Settings. Defaults are conservative for new installs (anonymous REST lockdown and HSTS are off).
- Optional: enable two-factor authentication on each administrator Profile.
- Optional: Magic Login — send a test email first, then enable the one-time link. Opening the link requires a confirm click so email scanners cannot sign anyone in.
- If you hide the login URL, bookmark the secret slug. Locked out? Add define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true ); to wp-config.php, or deactivate the plugin over FTP / file manager.
Privacy
When logging is enabled, the plugin stores IP addresses, user agents, requested URLs, and short event details in a table on this site. Data is not sent to the plugin author. Suggested privacy-policy text is added under Tools → Privacy.
Personal data export and erase callbacks are registered. Email is used only when an administrator enables magic login, login alerts, or the weekly digest.
Third-party services
None. Reverse-DNS crawler verification (optional) uses the server’s DNS resolver only.