=== Allimedia Login & Prefix Guard ===
Contributors: allimedia
Tags: login security, wp-login, database prefix, security, admin login
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.1.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Protect the login URL and change the database prefix through a verified workflow with readiness checks and automatic rollback.

== Description ==

Allimedia Login & Prefix Guard combines two focused hardening workflows: a private login URL that reduces automated login noise and a controlled database table prefix changer for sites that still use a predictable prefix such as wp_.

Unlike a login-only URL hider, the plugin treats a database prefix change as a verified workflow. It checks the installation before making changes, maps core and custom tables, validates metadata and collisions, coordinates wp-config.php with the database operation, verifies the resulting site state and automatically rolls back if any post-change integrity check fails.

The plugin is intentionally small: no tracking, no external services, no remote assets, no ads, and no public "powered by" links.

= Main features =

* Hide direct requests to wp-login.php and wp-admin from logged-out visitors with a 404 response.
* Set a private custom login slug from the WordPress admin.
* Generate a random login slug automatically on new installations.
* Generate a new random login slug from the settings screen.
* Update WordPress login, logout, registration and lost password links.
* Rename database tables from the current prefix to a new prefix.
* Generate a random database prefix when you do not want to choose one manually.
* Run a readiness check before changing the prefix, including core table completeness, metadata collisions, database privileges, wp-config.php status and in-memory rollback readiness.
* Preview the complete impact map and distinguish WordPress core tables from plugin or custom tables.
* Update related user role and usermeta keys during the prefix change.
* Verify every renamed table, wp-config.php, role metadata, user capabilities, site URL data and the active WordPress prefix after the operation.
* Automatically restore the original tables, metadata and wp-config.php when any post-change integrity check fails.
* Show a one-time post-change integrity report to the administrator.
* Retain the original wp-config.php content only in memory during the synchronous operation; no configuration backup is stored on disk.
* Require administrator permission, nonce verification and backup confirmation before database changes.
* Copy the custom login URL from the settings screen.
* Use WP-CLI commands for prefix generation, preview and change.

= Important backup notice =

Changing the database table prefix is a sensitive maintenance task. Always create a full database backup and an external wp-config.php backup before using the prefix changer. The plugin does not create a database backup and does not store a wp-config.php backup anywhere on disk. The original configuration is retained only in memory for an automatic rollback during the synchronous operation.

= Privacy =

Allimedia Login & Prefix Guard does not collect personal data, does not contact external servers and does not add tracking scripts.

= Languages =

The plugin is fully internationalized. Community translations are managed and delivered through translate.wordpress.org.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/allimedia-login-prefix-guard/`.
2. Activate the plugin through the Plugins screen in WordPress.
3. Go to Settings > Allimedia Login & Prefix Guard.
4. Set your custom login slug and enable login protection.
5. Save the new login URL in a secure place before logging out.

== Frequently Asked Questions ==

= Will this change WordPress core files? =

No. The plugin does not edit WordPress core files. The database prefix tool updates database table names and wp-config.php only after an administrator explicitly confirms the action.

= How is this different from a login-only URL hider? =

Login URL protection is one half of the plugin. The second core workflow treats a database prefix change as a verified operation with a readiness report, core/custom table impact map, identifier and metadata collision validation, post-change integrity verification, coordinated wp-config.php handling and verified automatic rollback.

= Can I use the prefix changer on multisite? =

No. Prefix changing is disabled on multisite installations because table mapping is more complex and should be handled manually by an experienced administrator.

= What happens to wp-login.php? =

When login protection is enabled, direct requests to wp-login.php return a 404 response. WordPress login links are changed to your custom login slug.

= What happens when a logged-out visitor opens wp-admin? =

The request returns a 404 response instead of redirecting to and revealing the custom login URL. Public endpoints required by WordPress and plugins remain available.

= What should I do before changing the database prefix? =

Create a full database backup and a wp-config.php backup. Also make sure you have filesystem or hosting panel access in case you need to restore the site.

= Can I preview the prefix change first? =

Yes. Use the Preview prefix change button to see every planned rename and a readiness report covering core tables, custom tables, WordPress metadata, collisions, wp-config.php, in-memory rollback readiness and database privileges. A failed readiness check blocks the operation.

= Does the plugin include WP-CLI commands? =

Yes. Use `wp login-prefix-guard generate`, `wp login-prefix-guard preview newprefix_` and `wp login-prefix-guard change newprefix_ --confirm-backup --yes`.

= Does the plugin send data to Allimedia.cz or any third party? =

No. The plugin does not send data to external servers.

= How do I enable Czech? =

Set the WordPress site language or your user profile language to Czech. The plugin interface will switch automatically.

== Screenshots ==

1. Login protection and database prefix settings.

== Changelog ==

= 1.1.2 =
* Removed all on-disk wp-config.php rollback copies; the original content is retained only in memory during the operation.
* Initialized file access through the standard WordPress Filesystem API.
* Simplified configuration rollback and clarified escaped administrator output.

= 1.1.1 =
* Fixed activation when migrating from the legacy login-prefix-guard plugin folder.
* Automatically deactivated the loaded legacy copy before activating the WordPress.org-slugged package.
* Added an administrator notice identifying the old plugin folder that can be removed after verification.

= 1.1.0 =
* Added a database prefix readiness report with seven checks before any table is changed.
* Added an impact map that distinguishes WordPress core tables from plugin and custom tables.
* Added six post-change integrity checks covering table names, wp-config.php, roles, user capabilities, site URL data and the active WordPress database prefix.
* Added verified automatic rollback when any post-change integrity check fails.
* Added one-time integrity reports in wp-admin and expanded WP-CLI readiness output.

= 1.0.15 =
* Replaced persistent wp-config.php backups with protected, non-executable temporary rollback copies inside the runtime uploads directory.
* Removed every temporary rollback copy after successful completion or rollback and verified wp-config.php writes and restores.
* Switched configuration file operations to the WordPress Filesystem API.
* Removed bundled translation files in favor of translate.wordpress.org delivery.
* Clarified the distinct database-prefix workflow in the plugin description and FAQ.

= 1.0.14 =
* Added the official Allimedia product and author metadata.
* Migrated the translation domain and distribution package to the allimedia-login-prefix-guard WordPress.org slug.
* Aligned the main plugin filename with the distribution slug.
* Preserved existing settings, the admin page URL and WP-CLI command for backward compatibility.

= 1.0.13 =
* Updated WordPress compatibility metadata for WordPress 7.1.
* Loaded the custom login after WordPress initialization and initialized core login globals.
* Avoided loading the active theme while blocking logged-out wp-admin requests.
* Added preflight validation for invalid or overly long database table names.
* Updated prefixed usermeta keys without replacing later text matches.
* Cleared role and user metadata caches after a prefix change.
* Synchronized the active WordPress database connection after table renaming.
* Added a bundled user manual and Help link.

= 1.0.12 =
* Renamed the public plugin name to start with the Allimedia brand for WordPress.org naming compliance.

= 1.0.11 =
* Added safer rollback handling for partially failed database prefix metadata updates.
* Report incomplete automatic rollback when wp-config.php cannot be updated after table renaming.
* Updated release metadata in bundled translation files.

= 1.0.10 =
* Reworked table-prefix SQL statements to use prepared %i identifier placeholders.
* Updated compatibility metadata to WordPress 7.0.

= 1.0.9 =
* Fixed WordPress.org plugin-check findings around prefix file writability checks, nonce-verified admin messages and discouraged textdomain loading.
* Documented intentional direct database operations needed for table prefix changes with validated identifiers.

= 1.0.8 =
* Added a protected wp-content fallback when the parent WordPress directory cannot be used for wp-config.php backups.
* Checked backup directory protection files before accepting a backup directory.

= 1.0.7 =
* Added a random token to wp-config.php backup filenames.
* Added consistent file locking when creating backup directory protection files.

= 1.0.6 =
* Fixed parent-directory path handling for wp-config.php and backup storage.
* Added a protected backup-file prelude.
* Localized WP-CLI output.
* Clarified that the plugin does not create a database backup.

= 1.0.5 =
* Moved wp-config.php backups outside ABSPATH and stopped exposing full backup paths in admin notices.
* Fixed table collision checks for underscores in MySQL LIKE patterns.
* Added stricter prefix validation and stronger confirmation before changing the database prefix.
* Registered WP-CLI commands on cli_init and added --yes for prefix changes.
* Removed double URL encoding in admin redirect messages.
* Expanded reserved login slug checks.

= 1.0.4 =
* Added a random default login slug for new installations.
* Added a login URL generator for existing installations.
* Added bundled Czech translation.

= 1.0.3 =
* Prevented wp-admin from revealing the custom login URL to logged-out visitors.
* Preserved public admin AJAX, form action and asset endpoints.

= 1.0.2 =
* Added stricter PHP declarations.
* Added deferred admin script loading.
* Added project .gitignore.
* Added release checks for UTF-8 BOM and ZIP paths.

= 1.0.1 =
* Added random prefix generator.
* Added prefix change dry run preview.
* Added custom login URL copy button.
* Added one-time recovery guidance after enabling login protection.
* Added WP-CLI commands for generate, preview and change.

= 1.0.0 =
* Initial release.
