EDZNET Security Guard
EDZNET Security Guard stops the most common takeover techniques seen on compromised WordPress sites: Two-Factor Authentication Require two-factor authentication (2FA) for administrator logins using the TOTP standard (RFC 6238) and any authenticator app — Google Authenticator, Authy, 1Password, Micro
EDZNET Security Guard stops the most common takeover techniques seen on compromised WordPress sites:
Two-Factor Authentication
Require two-factor authentication (2FA) for administrator logins using the TOTP standard (RFC 6238) and any authenticator app — Google Authenticator, Authy, 1Password, Microsoft Authenticator, or similar. Setup is guided: the administrator scans a QR code from their profile or the login page and enters a 6-digit code that changes every 30 seconds. The code is verified on the server against an encrypted secret, and after a successful 2FA login the normal “admin logged in” email is still sent.
You can require 2FA for all administrators, force new administrators to set it up, or force every administrator to enroll on their next login. Existing administrators are never locked out — anyone who hasn’t set it up yet is walked through enrollment before they can finish logging in.
Block Administrator Creation
A compromised admin account will often create a second administrator account as a backdoor — one that survives after the original breach is cleaned up. While this setting is enabled, no new user can be created with the Administrator role and no existing user can be promoted to one . Existing administrators are unaffected, so the first administrator can still manage the site and change the setting whenever a legitimate admin account is needed.
Block URL Credentials
Brute-force scripts frequently hammer wp-login.php with credentials baked into the URL, e.g. https://yoursite.com/wp-login.php?log=Ben&pwd=T3m . While enabled, any visit to the login page with credentials in the query string is refused with 403 Forbidden . All logins must use the normal login form.
Admin Login Alerts
Every time an administrator signs in, an email is sent with the username, the IP address they connected from, their browser, and the exact time. Legitimate admin logins are rare, so an alert for a login you didn’t make is an early warning that an account may be compromised. Alerts are on by default and go to the first administrator’s email address — you can point them at any address from the settings page.
Block Accounts
Block any account from logging in with a single click — the “Block login” action appears on the Users screen, and “Unblock login” restores it whenever you’re ready. A blocked account is refused at the login screen with a friendly message, and its existing sessions are ended immediately so it can’t stay signed in. Because the plugin is built around the first-administrator lock, it can also block administrator accounts: any administrator can block a non-admin account, while only the first administrator can block another administrator. The first administrator’s own account can never be blocked, so you can’t lock yourself out of the site.
