=== KHALAF Login Access Guard ===
Contributors:      khalaf22
Tags:              login, security, hide login, custom login url, brute force
Requires at least: 5.0
Tested up to:      6.7
Stable tag:        1.0.0
Requires PHP:      7.4
License:           GPLv2 or later
License URI:       https://www.gnu.org/licenses/gpl-2.0.html

Protect your WordPress login page by moving /wp-login.php to a secret URL, with a fully customizable Access Denied page and live preview.

== Description ==

**KHALAF Login Access Guard** defends your WordPress website against automated bots, brute-force attacks, and credential stuffing by transforming the standard `/wp-login.php` path into a private, customizable URL of your choice.

Unlike typical hide-login plugins that simply display a generic 404 error or a blank screen, **KHALAF Login Access Guard** provides a dedicated visual customizer and a real-time live preview inside your dashboard to design a modern, branded 403 Access Denied page for blocked visitors.

= Key Features =

* **Custom Secret Login URL**: Move `/wp-login.php` to any custom slug (e.g. `/my-secret-door`).
* **Visual Access Denied Customizer**: Full control over background gradients/colors, card border radius, shadows, padding, icons, typography, and button styling.
* **Interactive Live Preview**: Preview your custom 403 Forbidden page in real time directly from the admin settings before publishing.
* **Dual-Language & RTL Ready**: Native support for Arabic and English with seamless RTL (right-to-left) typography and layout switching.
* **XML-RPC Attack Defense**: Optional toggle to block automated attacks targeting `xmlrpc.php`.
* **Zero Disruption to Core Actions**: Password recovery links with secure reset tokens, logout, privacy confirmations, and protected post actions continue working seamlessly.
* **Safe Redirect Option**: Option to redirect unauthorized attempts to any custom URL on your domain instead of rendering the denied page.
* **One-Click Toggle**: Activate or deactivate protection anytime without losing your customized design or settings.
* **Cryptographic Slug Generator**: Generate secure, randomized login slugs using browser cryptographic randomness with one click.
* **Non-Intrusive Admin Notices**: Dismissible dashboard reminders compliant with WordPress Guidelines.

= Security Notes =

* The plugin does **not** alter the WordPress admin dashboard (`/wp-admin`). Once logged in, administrators and authors work normally.
* Hiding your login URL provides a strong layer of defense against automated scanning bots, but should be combined with strong passwords and 2FA.
* The redirect option restricts destination targets to the same site domain to eliminate open-redirect vulnerabilities.
* Reserved system slugs (`wp-admin`, `admin`, `login`, `xmlrpc`, `wp-json`, etc.) are blocked from being set as the login slug.
* All settings and requests are sanitized, validated, and escaped following WordPress coding standards.

== Installation ==

1. Upload the `khalaf-login-access-guard` folder to your `/wp-content/plugins/` directory.
2. Activate the plugin via **Plugins → Installed Plugins**.
3. Navigate to **Login Access Guard** in the WordPress admin menu.
4. Set your desired custom slug or click **Generate** for a secure random slug.
5. (Optional) Customize your Access Denied page and preview it in real time under the **Style & Live Preview** tab.
6. Toggle **Enable Protection** and save your settings.

== Frequently Asked Questions ==

= I forgot my custom login URL. How do I regain access? =

You can regain access at any time via FTP or your hosting File Manager: temporarily rename the `khalaf-login-access-guard` directory inside `/wp-content/plugins/` or delete the `klguard_settings` entry in `wp_options`. WordPress will immediately revert to the default `/wp-login.php`.

= Does this plugin work with WooCommerce and membership plugins? =

Yes. The plugin only intercepts direct visits to `/wp-login.php` and protects the admin area against unauthenticated access. It does not alter frontend account pages or WooCommerce endpoints.

= Will this break password reset emails or logout? =

No. Legitimate password reset links containing verification tokens, logout requests, and GDPR privacy actions are whitelisted and execute normally.

= Does it work with caching plugins? =

Yes. Ensure your caching plugin (WP Rocket, LiteSpeed, W3 Total Cache, etc.) is configured to exclude your custom secret login slug from page caching.

== Screenshots ==

1. General configuration tab with secret slug generator and copy-to-clipboard button.
2. Content and dual-language (Arabic/English) blocked page editor.
3. Appearance customizer with interactive real-time live preview.
4. Branded 403 Access Denied page displayed to unauthorized visitors.

== Changelog ==

= 1.0.0 =
* Initial release of KHALAF Login Access Guard.
* Fully customizable 403 Access Denied page with real-time live preview.
* Native dual-language (Arabic & English) with RTL support.
* Cryptographic slug generator using window.crypto.
* XML-RPC brute force protection toggle.
* Full WordPress.org plugin directory compliance.

== Upgrade Notice ==

= 1.0.0 =
Initial release.
