=== Protect WP Login – Password Protect wp-login.php with Basic Auth ===
Contributors: clickar, alebuo
Tags: login, security, brute force, htaccess, basic auth
Requires at least: 6.0
Tested up to: 7.1
Stable tag: 1.1.2
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Password protect wp-login.php with HTTP Basic Authentication. Stops bots and brute force attacks at the server, before WordPress even loads.

== Description ==

Protect WP Login adds a second password in front of your WordPress login page. Before the login form is shown, the web server asks for an extra username and password (HTTP Basic Authentication through `.htaccess`). Bots and brute force attacks are rejected by the server, so they never reach WordPress, PHP or your database.

### Why protect wp-login.php at the server level?

Every request to `wp-login.php` loads WordPress and queries the database, even when it comes from a bot trying thousands of passwords. Plugins that limit login attempts or add a CAPTCHA still have to do that work for every attempt. With Protect WP Login the server rejects those requests before WordPress starts:

* Brute force bots don't consume PHP or database resources.
* Attackers never see your login form, so they can't try WordPress passwords.
* No CAPTCHA to solve and no extra scripts on the login page.
* It works together with Wordfence, Limit Login Attempts, two-factor authentication and other security plugins: it's one more layer in front of them.

### Features

* Password protects `wp-login.php` with server-level HTTP Basic Authentication.
* Optionally protects `xmlrpc.php`, another common target of brute force attacks.
* Creates a random username and password on activation, and keeps them visible until you confirm you saved them.
* Checks the protection right after writing the rules. If your hosting doesn't support them, they are removed automatically so your site keeps working.
* Status panel that shows whether the protection is really active.
* Password protected posts keep working for your visitors.
* Unlimited users, managed from the WordPress admin.
* Translated into English, Spanish, German, French, Italian and Portuguese.

### How it works

1. A visitor or a bot opens `wp-login.php`.
2. The web server asks for the extra username and password managed by the plugin.
3. Only with the right credentials the usual WordPress login form is shown. Wrong credentials are rejected by the server.

### Requirements

* Apache or LiteSpeed web server with `.htaccess` support (most shared hosting). On Nginx, the plugin shows the configuration to add to the server.
* Single site installations. WordPress Multisite is not supported yet.

== Installation ==

1. Install the plugin from 'Plugins > Add New Plugin', or upload the plugin files to the `/wp-content/plugins/protect-wp-login` directory.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. You will be taken to the 'Protect WP Login' page, where the generated username and password are shown. **Save them** before logging out, or create your own users on the same page.

== Frequently Asked Questions ==

= How is it different from other login security plugins? =

Plugins like Wordfence or Limit Login Attempts check each login attempt inside WordPress, after it has loaded. Protect WP Login blocks the request at the web server, before WordPress loads, so bots don't use your server resources. You can use both: Protect WP Login is an extra layer in front of your security plugin.

= I got locked out. How do I get back in? =

Connect to your site by FTP or with the file manager of your hosting, open the `.htaccess` file in the WordPress folder and delete the lines between `# BEGIN Protect WP Login` and `# END Protect WP Login`. You can also rename the `wp-content/plugins/protect-wp-login` folder to deactivate the plugin.

= Will it work on my hosting? =

It works on Apache and LiteSpeed servers that allow `.htaccess` files, which covers most shared hosting. After writing the rules the plugin checks your site: if the server answers with an error, the rules are removed automatically and the status panel explains what happened.

= Does it work on Nginx? =

Nginx doesn't read `.htaccess` files. The plugin page shows the configuration you (or your hosting provider) have to add to the Nginx server to protect `wp-login.php` with the same users.

= Do password protected posts still work? =

Yes. Visitors can still unlock password protected posts and pages without knowing the extra credentials.

= Should I also protect xmlrpc.php? =

If you don't use Jetpack, the WordPress mobile app or another service that publishes through XML-RPC, enabling it blocks another common entry point for brute force attacks.

= Do I need to enter the extra password every time? =

Browsers remember Basic Authentication credentials during the session, and most of them (Chrome, Firefox, Edge, Safari) offer to save them like any other password, so you don't have to type them again.

= How do I add or delete users? =

Go to the 'Protect WP Login' page in the admin menu. Enter a username and password and click 'Save' to add a user, or click 'Delete' next to an existing user. There is always at least one user.

= Do I need a complex username and password? =

A simple combination is enough to stop bots, because they are blocked before reaching WordPress. The password can't be the same as the username.

= Is it secure without HTTPS? =

Basic Authentication sends the credentials in every request to `wp-login.php`, just like the WordPress login form. Use HTTPS (free with Let's Encrypt on most hosting) to keep them private.

== Screenshots ==

1. Status panel: the protection is active, with the XML-RPC option and the list of users.
2. The username and password generated on activation stay visible until you confirm you saved them.
3. A reminder is shown on the dashboard until the generated credentials are saved.
4. The browser asks for the extra username and password before showing wp-login.php.
5. After the extra authentication, the usual WordPress login form appears.
6. Adding a new user. The list shows all the users that can pass the extra authentication.
7. If the hosting doesn't support the rules, they are removed automatically and the panel explains why.

== Changelog ==

= 1.1.2 =
* Translations: the plugin name is no longer translated, and Spanish uses the informal form, following the WordPress.org translation style guides.

= 1.1.1 =
* New: interface translated into Spanish, German (formal and informal), French, Italian and Portuguese (Brazil and Portugal). Regional variants, such as Spanish from Argentina or Mexico, use the closest translation.
* New: link to leave a review on the plugin page.
* Improved description, FAQ and screenshots.
* Updated plugin and author URLs.

= 1.1 =
* New: the generated credentials stay visible until you confirm you saved them (before, they disappeared after 60 seconds).
* New: automatic check after writing the rules. If the server returns an error 500, the rules are removed so the site keeps working.
* New: status panel with the protection state and a "Check again" button.
* New: option to also protect xmlrpc.php.
* New: instructions for Nginx servers.
* Fix: password protected posts asked visitors for the extra credentials.
* Fix: passwords with special characters (such as < or %) were changed before being saved.
* Fix: the rules were duplicated when reactivating the plugin, and were not removed from .htaccess files with Windows line endings.
* Fix: uninstalling the plugin now also removes the rules from .htaccess.
* Fix: the global ErrorDocument 401/403 rules no longer affect the rest of the site.
* Security: web access to the folder that stores the password file is now blocked.
* Improvement: the plugin no longer touches the file system on every page load.
* Tested with WordPress 7.1 and PHP 8.2.

= 1.0 =
* Initial release.

== Upgrade Notice ==

= 1.1.2 =
Translation improvements.

= 1.1.1 =
Adds translations into Spanish, German, French, Italian and Portuguese.

= 1.1 =
Fixes password protected posts, safer .htaccess handling with automatic rollback, and credentials that no longer disappear after activation. Your existing users are kept.
