About this plugin
EDZNET Security Guard stops the most common takeover techniques seen on compromised WordPress sites: Two-Factor Authentication Require two-factor authentication (2FA) for administrator logins using the TOTP standard (RFC 6238) and any authenticator app — Google Authenticator, Authy, 1Password, Microsoft Authenticator, or similar. Setup is guided: the administrator scans a QR code from their profile or the login page and enters a 6-digit code that changes every 30 seconds. The code is verified on the server against an encrypted secret, and after a successful 2FA login the normal “admin logged in” email is still sent. You can require 2FA for all administrators, force new administrators to set it up, or force every administrator to enroll on their next login. Existing administrators are never locked out — anyone who hasn’t set it up yet is walked through enrollment before they can finish logging in. Block Administrator Creation A compromised admin account will often create a second administrator account as a backdoor — one that survives after the original breach is cleaned up. While this setting is enabled, no new user can be created with the Administrator role and no existing user can be promoted to one . Existing administrators are unaffected, so the first administrator can still manage the site and change the setting whenever a legitimate admin account is needed. Block URL Credentials Brute-force scripts frequently hammer wp-login.php with credentials baked into the URL, e.g. https://yoursite.com/wp-login.php?log=Ben&pwd=T3m . While enabled, any visit to the login page with credentials in the query string is refused with 403 Forbidden . All logins must use the normal login form. Admin Login Alerts Every time an administrator signs in, an email is sent with the username, the IP address they connected from, their browser, and the exact time. Legitimate admin logins are rare, so an alert for a login you didn’t make is an early warning that an account may be compromised. Alerts are on by default and go to the first administrator’s email address — you can point them at any address from the settings page. Block Accounts Block any account from logging in with a single click — the “Block login” action appears on the Users screen, and “Unblock login” restores it whenever you’re ready. A blocked account is refused at the login screen with a friendly message, and its existing sessions are ended immediately so it can’t stay signed in. Because the plugin is built around the first-administrator lock, it can also block administrator accounts: any administrator can block a non-admin account, while only the first administrator can block another administrator. The first administrator’s own account can never be blocked, so you can’t lock yourself out of the site. Every attempt to sign in as a blocked account is logged — username, IP address, browser and time — on the EDZNET Guard settings page, so you can see who keeps trying. First Administrator Lock The same first-administrator lock applies to every setting in the plugin — including two-factor authentication — so a compromised admin account cannot quietly weaken the protections. Comment Controls The same first-administrator lock protects three comment tools: Disable comments globally — turn commenting off site-wide with a single toggle. Comment forms disappear from the front end and newly published posts default to closed comments. Force close comments — one click updates every existing post so comments and pingbacks are closed, without having to edit posts one by one. Delete all pending comments — a danger action that permanently deletes every comment still awaiting moderation, without first marking each as spam or trashing it. Confirmation is required before it runs. Front-end Content Tuning Hide what you don’t want visitors to see, with each toggle independent of the others: Hide post authors — removes the “by [author]” meta from your posts. Hide post dates — removes publish dates from your posts. Hide comment closed text — removes the “Comments are closed” / “Comments Off” wording that appears under posts where commenting is disabled. These are quick front-end filters and CSS rules that work with most themes. Go Further: EDZNET Geolocation Security Guard pairs naturally with our EDZNET Geolocation plugin. Once installed, block logins, comments and whole countries by visitor location, block individual IPs, and see where your visitors come from — a useful layer on top of the protections here. Security Guard detects the plugin and links straight to its country-blocking screen. You can grab it from WordPress.org: https://wordpress.org/plugins/edznet-geolocation/ The block, the alert, and the comment and content toggles are on/available by default and need no configuration after activation. Two-factor authentication is off by default — turn it on from the settings page (you’ll be prompted to set up your own code first). Source Code This plugin is distributed as complete, human-readable source. Every PHP, JavaScript and CSS file shipped in the plugin ZIP is the original source file — nothing is minified, compiled, obfuscated, transpiled or bundled, and there is no build step, package manager or build tool of any kind involved in producing a release. What you download is what was written. Runtime CSS lives in css/ and runtime JavaScript in js/ , both loaded through wp_enqueue_style() / wp_enqueue_script() . The only third-party file is the QR-code library credited below, which is also shipped as its original unminified source. Third-Party Libraries qrcode.js ( js/qrcode.js ) — by davidshimjs, based on the “QR Code for JavaScript” library by Kazuhiko Arase. Licensed under the MIT license. Upstream: https://github.com/davidshimjs/qrcodejs. Shipped unmodified and unminified; used to draw the TOTP enrollment QR code in the browser so that no secret ever leaves the site. No External Services This plugin does not contact any external service. Two-factor codes are generated and verified entirely on your own server, the QR code is drawn in the browser by the bundled qrcode.js , and no data about your site, its users or its visitors is transmitted anywhere.