About this plugin
ZA Creative Login Shield is a comprehensive enterprise-grade security platform that protects your WordPress site against brute force attacks, unauthorized access, credential stuffing, file tampering, and known vulnerabilities. It provides 28 integrated security features with an intuitive dashboard.
⭐ Security Health Score
Weighted security score (0-100) with star rating (⭐⭐⭐⭐⭐) and detailed check breakdown. 23 automated checks including 2FA, rate limiting, password policy, SSL, file integrity, vulnerability scanning, admin username, XML-RPC, debug mode, and more.
🔐 Two-Factor Authentication (2FA)
Email OTP and Google Authenticator (TOTP) support with per-role enforcement. Force 2FA for administrators, editors, or any custom role.
🔑 Passkeys & WebAuthn
Support for Windows Hello, Face ID, Touch ID, Android Passkeys, and physical security keys. Users can register multiple credentials from their profile page.
⚡ One-Click Security Wizard
Apply all recommended security settings with one click: 2FA, rate limiting, password policy, email notifications, custom login URL, session timeout, device tracking, and more.
📊 Analytics Dashboard
Professional analytics with login activity charts, browser distribution, operating systems, 24-hour attack timeline, top attackers, country statistics, success/failure rates, and most attacked usernames. AJAX-loaded with period switching.
🎯 Risk Scoring per Login
Five-factor risk scoring engine evaluating IP reputation, new device detection, failed attempt history, TOR/VPN detection, and geolocation changes. Scores classify logins as Low, Medium, High, or Critical.
👤 Session Manager
View all active sessions with user, device, browser, country, and last activity. Terminate individual sessions or force logout all sessions.
📱 Device Trust
Recognize trusted devices via browser fingerprinting. Unknown devices trigger email verification before allowing access.
🛡️ Emergency Lockdown
One-click lockdown disables all logins, XML-RPC, REST API authentication, and new user registration. Whitelist IPs for emergency access. Full audit trail logging.
📁 File Integrity Monitor
htaccess for unauthorized changes. Detects modified, missing, and new files with hash verification.
🔍 Vulnerability Scanner
Connects to WPScan API and GitHub vulnerability feeds to check installed plugins and themes against known security vulnerabilities. Severity ratings (Critical, High, Medium, Low).
🦠 Malware Scanner
Detects suspicious PHP patterns including base64 encoded payloads, eval() execution, shell_exec() calls, and recently modified files during file integrity scans.
🔒 Password Policy
Enforce minimum length, uppercase, lowercase, numbers, special characters, password expiration (days), password history (prevent reuse), and block 26+ common passwords.
🧠 AI Security Assistant
Smart daily briefing generating natural-language security summaries: “You had 53 login attempts. 43 blocked. 8 from Russia.
” Contextual recommendations based on real-time activity.
🎨 Login Branding
Customize login page with custom logo image, logo URL, logo title, background color, form background, text color, primary button color, custom CSS, header HTML, and footer HTML.
📧 Advanced Email Templates
Six professional HTML email templates with inline CSS: login notification, blocked IP alert, scheduled report, device verification, OTP code, and default template. Dark-mode compatible.
🔔 Notification Center
In-WordPress notification system with dismiss functionality and unread counts. Alerts for blocked attacks, new IPs, plugin updates, and 2FA changes. Stored per user.
📋 Audit Trail
Complete action log for all security events: settings changes, IP blocks, lockdown activation, user sessions, file scans, vulnerability scans, report generation, and wizard actions.
📅 Scheduled Security Reports
Daily, weekly, or monthly email reports delivered in beautiful HTML format. Includes login statistics, blocked IPs, top attackers, and country breakdown. PDF download available.
📤 Export Everything
Export login logs, blocked IPs, and comprehensive security reports in CSV, JSON, and PDF formats. One-click download from any admin page.
🌐 Public REST API
Eight REST API endpoints under zacls/v1: get stats, get logs, get blocked IPs, get analytics, get health score, get reports, enable lockdown, and disable lockdown.
⚡ Performance Dashboard
Monitor memory usage, database size, cron job status, database query count, and per-table row counts for all plugin tables. Memory usage indicator with percentage.
🧹 Auto Cleanup
Automatically delete old login logs, audit logs, expired sessions, and risk scores. Configurable frequency (daily, weekly, monthly) and retention period (7-365 days).
🔌 Integrations
- Cloudflare – One-click import of Cloudflare IP ranges to restore real visitor IPs.
- ip-api.com – Free GeoIP country lookup (no API key required).
- WPScan API – Vulnerability database for plugin and theme scanning.
Privacy
This plugin stores the following information:
- Login attempt records
- IP addresses
- Device fingerprint identifiers (opt-in, disabled by default)
- WebAuthn credential IDs (public key only, no private keys stored)
- Risk score evaluations
- Audit trail events
- Two-factor authentication status
- File integrity hashes
- Vulnerability scan results
- User notification preferences
All data is stored locally inside the WordPress database.
com if GeoIP is enabled (opt-in, disabled by default). Cloudflare API requests (manual admin action) send no visitor data. WPScan API requests send installed plugin slugs and versions.
Site administrators are responsible for complying with local privacy laws.
Full data removal on uninstall (all database tables and options cleaned up).
External Services
This plugin uses the following external services:
Cloudflare API
- Purpose: Fetch Cloudflare IP ranges for restoring real visitor IPs behind Cloudflare proxy.
- Data Sent: None beyond the standard HTTP request to api.cloudflare.com.
- Trigger: Manual admin action (button click on settings page).
- Privacy Policy: https://www.cloudflare.com/privacypolicy/
- Terms of Service: https://www.cloudflare.com/website-terms/
ip-api.com
- Purpose: GeoIP country code lookup for login attempts and blocked IPs.
- Data Sent: Visitor IP address.
- Trigger: Any login attempt when GeoIP is enabled in settings (opt-in, disabled by default).
- Terms of Service: https://ip-api.com/docs/legal
- Privacy Policy: https://ip-api.com/docs/legal
WPScan API
- Purpose: Check installed plugins against known WordPress vulnerabilities.
- Data Sent: Installed plugin slugs and version numbers.
- Trigger: Vulnerability scan initiated from admin panel.
- Privacy Policy: https://wpscan.com/privacy