=== GhostLock Hide Login ===
Contributors: iamshubhamsp, walstarmedia
Tags: security, hide login, brute force protection, wp-admin security, login protection
Requires at least: 5.8
Tested up to: 7.1
Stable tag: 1.0.4
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Hide WordPress login URLs and protect against brute-force attacks with IP blocking, country detection, logs, and IP whitelisting.

== Description ==

GhostLock Hide Login is a lightweight WordPress security plugin that combines login URL protection and automatic brute-force attack prevention in a single plugin.

Unlike many security plugins that require manual configuration, GhostLock Hide Login starts protecting your website immediately after activation.

Features:

- Hide wp-login.php
- Protect wp-admin access
- Change the default WordPress login URL
- Automatic brute-force attack protection
- Automatically block suspicious IP addresses
- Detect attacker countries
- Security activity logs
- Whitelist trusted IP addresses
- Redirect attackers to custom 404 pages
- Show custom blocked access pages
- Lightweight and easy to use
- No complex configuration required

GhostLock Hide Login helps reduce unauthorized login attempts and improves WordPress website security with minimal setup.

== Installation ==

= Install from WordPress Admin Dashboard =

1. Go to Plugins → Add New in your WordPress admin dashboard.
2. Click Upload Plugin.
3. Upload the `ghost-hide-login.zip` file.
4. Click Install Now.
5. Activate the plugin through the Plugins screen.
6. Go to Settings → GhostLock Hide Login.
7. Configure your custom login URL and security settings.

= Manual Installation =

1. Upload the plugin files to the `/wp-content/plugins/ghost-hide-login` directory.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Go to Settings → GhostLock Hide Login.
4. Configure your plugin settings.

== Frequently Asked Questions ==

= Will this hide wp-login.php? =

Yes. Direct access to wp-login.php and wp-admin can be restricted and protected using your custom login URL.

= Does the plugin automatically protect against brute-force attacks? =

Yes. GhostLock Hide Login automatically limits suspicious login attempts and blocks malicious IP addresses after activation without additional setup.

= Can I unblock IPs manually? =

Yes. You can manage and remove blocked IP addresses from the plugin settings page.

= Does this plugin use third-party services? =

Yes. Country detection uses the ipwho.is (ipwhois.io) service over HTTPS. Results are cached for 24 hours per IP address.

== Screenshots ==

1. GhostLock Hide Login settings page
2. Blocked IP management
3. Security logs dashboard
4. Custom login URL settings

== Changelog ==

= 1.0.4 =
* Fix Plugin Check warnings by prefixing local variables in the admin settings page.
* Shorten the readme short description to the WordPress 150-character limit.

= 1.0.3 =
* Stop trusting spoofable forwarding headers for client IP detection.
* Use REMOTE_ADDR by default for brute-force and country-cache keys.
* Add the `ghost_login_client_ip` filter for trusted reverse-proxy integrations.

= 1.0.1 =
* Initial release
* Hide wp-login.php
* Protect wp-admin
* Custom login URL support
* Automatic brute-force protection
* Automatic IP blocking
* Country detection
* Security logs
* IP whitelist
* Custom 404 redirect page
* Custom blocked page support

== Privacy ==

GhostLock Hide Login uses the third-party service ipwho.is (ipwhois.io) to detect attacker countries.

Data Sent:
- Visitor IP address

Purpose:
- Country detection for security monitoring and attack logging

Service URL:
https://ipwhois.io/

Terms of Service:
https://ipwhois.io/terms