Mrsea Login

Mrsea Login brings a green-and-ivory design to the WordPress login page and lets site administrators choose a custom login URL. Users can add an extra verification step with a time-based authenticator app.

Login design

• Responsive desktop and mobile layouts.
• Readable form guidance, keyboard focus styles and password visibility control.
• Headings for login, registration and password-reset screens.
• Uses your existing site title. No remote fonts are loaded.

Custom login URL

• Choose your login slug under Settings > Mrsea Login.
• Redirect visitors away from the default login routes.
• Preserve normal password reset and registration routes through the custom URL.
• Changing the URL reduces exposure of the default route; it is not a replacement for authentication or other site security.

Optional two-factor authentication

• Compatible with Google Authenticator and standard TOTP apps using SHA-1, six digits and 30-second intervals.
• Scan a locally generated QR code or enter the setup key manually.
• Verify a code before protection is enabled for the account.
• Ten one-use recovery codes, with password-and-code verification to regenerate them.
• Encrypted authenticator secrets and hashed recovery codes.
• Retry limits and protections against reusing an accepted code.
• Existing enrollments and recovery codes are retained when updating from version 1.2.0.

Two-factor protection is optional and configured per account. Installing the plugin alone does not enable it for all users. HTTPS and PHP OpenSSL with AES-256-GCM support are required for enrollment.

Privacy and external services

Mrsea Login does not use a Google API, send setup secrets to a QR service, or load a remote QR library. The QR code is rendered in the user’s browser using bundled JavaScript. The plugin adds no analytics or telemetry.