Aegis User Guard 1.3.2 Documentation

Overview

Aegis User Guard adds focused identity-policy controls on top of WordPress authentication. It does not replace WordPress login, password hashing, sessions, or password-reset flows.

What the plugin protects Password freshness and complexity, inactive accounts, brute-force attempts, two-factor authentication, REST user enumeration, Administrator access, network rules, and security-event visibility.

All settings are managed from the native WordPress admin screen at Aegis User Guard. Every policy can be enabled or disabled independently, and disabling a rule preserves its saved configuration.

Requirements

WordPress 6.2 or newer.
PHP 7.4 or newer.
Administrator access for installation and policy changes.
A working site mail configuration for email notifications. Aegis sends mail through WordPress wp_mail().

Installation

Upload the aegis-user-guard folder to wp-content/plugins/, or upload the plugin ZIP under Plugins > Add New > Upload Plugin.
Activate Aegis User Guard from the Plugins screen.
Open Aegis User Guard in the WordPress admin sidebar.
Review the defaults, save the policies appropriate for your site, and configure email recipients before enabling alert events.

Before production use Confirm that wp_mail() is delivering successfully, keep a recovery Administrator account, and test policies with a non-critical user first.

Features

Core controls

Configure password freshness, password complexity, inactive-account lockout, brute-force protection, two-factor requirements, REST user-list restriction, Administrator alerts, and new-device alerts.

Recently added

See newly created accounts and their current access state in one quick review panel.

Email notifications

Edit one shared HTML template, subject, placeholder set, and recipient policy for Administrator security alerts. Recipient selection can target all or selected Administrators.

Administrator directory

Review every Administrator's last sign-in, active sessions, status, and available actions. Export the directory as CSV.

Access & IPs

Add explicit Block or Allow rules for IP addresses. Allow-listed addresses are exempted from brute-force lockouts.

Checklist

Run a read-only hardening audit for file editing, debug output, HTTPS, the default admin account, 2FA, REST enumeration, and pending updates.

Activity log

Search the latest security events, paginate through them, and export the log as CSV. The log retains the latest 100 entries.

WordPress user and profile screens

The Users screen exposes security status, pause/reactivate, force reset, sign-out-everywhere, and password-reset actions. A user's profile provides self-service TOTP setup and backup-code management.

Password freshness behavior

Password freshness is an authentication policy, not an email-based reminder workflow. When a password reaches the configured age, Aegis marks the account as expired, blocks the normal destination, and sends the user through the native WordPress password-change/profile flow. The feature does not automatically send a password-change email merely because the password became stale. Administrator alert emails for a later password change are a separate, configurable event.

Two-factor authentication

Aegis uses native PHP-compatible TOTP logic with a manual-entry secret and one-time backup codes. It does not depend on a QR-code service or an external API. Administrators can require 2FA for all Administrator accounts from Core controls.

Email delivery

Security events use the configured Aegis HTML template and the site's normal wp_mail() transport. If a mail plugin is installed, configure that transport separately. The Activity log records the email event; delivery itself is still subject to the site's mail server.

Feature screenshots

These screenshots were captured from the live WordPress admin at 2× scale and are included as package assets under screenshots/. Demo names and values shown in the images belong to the sandbox used for the capture.

Aegis User Guard Core controls screen — **Core controls**Identity policies and alert switches.

Aegis User Guard Recently added screen — **Recently added**New account review and access state.

Aegis User Guard Email notifications screen — **Email notifications**HTML template, subject, placeholders, and recipients.

Aegis User Guard Administrator directory screen — **Administrator directory**Administrator oversight and account actions.

Aegis User Guard Access and IPs screen — **Access & IPs**Manual allow and block rules.

Aegis User Guard Security checklist screen — **Checklist**Read-only WordPress hardening audit.

Aegis User Guard Activity log screen — **Activity log**Searchable, paginated security timeline.

WordPress Users screen with Aegis security status — **Users integration**Security status and per-account actions in the native Users screen.

Profile screenshot noteThe profile screen contains a live TOTP enrollment secret during setup. It is intentionally documented in text only and is not included as a distributable screenshot.

WPML compatibility

Aegis User Guard 1.3.1 includes wpml-config.xml and wraps the plugin's runtime interface, saved email subject, saved email HTML, JavaScript messages, CSV headings, and notification text in the aegis-user-guard text domain.

Register the plugin's translatable settings in WPML String Translation.
Translate the Administrator notification subject and message from the WPML string list.
Translate the admin interface and email content independently for each active site language.

Translation availability depends on the language files and WPML configuration installed on the destination site. The plugin does not bundle WPML.

Security model

Area	Implementation
Authentication	Hooks into native WordPress authentication and redirects; no replacement login system.
Passwords	Uses WordPress password APIs and user meta for policy timestamps and forced-reset state.
Sessions	Uses native session-token destruction for pause, forced reset, and sign-out-everywhere actions.
Settings	Stores configuration in standard WordPress options and protects changes with capability and nonce checks.
Activity	Stores the latest 100 events in a non-autoloaded WordPress option and supports CSV export.
Removal	Uninstall cleanup is handled by `uninstall.php`; disabling the plugin returns authentication to WordPress core behavior.

Support & changelog

For support, include your WordPress version, PHP version, Aegis version, enabled policies, and a reproducible description. Never send passwords, TOTP secrets, backup codes, or full production database exports.

Version 1.3.1

Preserved native WordPress and other plugin notices by removing admin notice suppression.
Removed inline admin style and script output and tightened capability/nonce validation ordering.
Refactored the plugin bootstrap and core class structure for WordPress coding standards compliance.
Improved PHP documentation, escaping, input handling, and translation annotations.
Consolidated the packaged documentation and retina screenshots under the documentation folder.

Version 1.3.2

Documented the optional Gravatar avatar service used by the Administrator directory, including the data transfer conditions and legal links.

Version 1.2.0

Added WPML compatibility metadata for saved Administrator email subject and message settings.
Localized dynamic admin JavaScript dialogs, validation messages, pagination, notification emails, and CSV exports.
Completed translation coverage for the plugin's runtime interface.

License: GPL-2.0-or-later. Author: QuantikLab.