=== Protect WP Login ===
Contributors: clickar, alebuo
Tags: login, security, brute force, htaccess, basic auth
Requires at least: 6.0
Tested up to: 7.1
Stable tag: 1.1
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stops bots and brute force attacks on wp-login.php with an extra server-level password (HTTP Basic Auth), before WordPress even loads.

== Description ==

Protect WP Login is a WordPress plugin designed to block bots and unauthorized users before they reach your `wp-login.php` page. By adding an additional layer of basic authentication via `.htaccess`, this plugin ensures that only users with the correct credentials can proceed to the WordPress login screen. This method minimizes unnecessary database queries and server load, effectively preventing brute force attacks without relying on resource-intensive CAPTCHA solutions.

**Key Features:**

* Protects the `wp-login.php` page with server-level authentication.
* Optionally protects `xmlrpc.php`, another common target of brute force attacks.
* Reduces server load by denying access before reaching the WordPress login form.
* Checks the protection automatically after activating it, and removes the rules by itself if your hosting doesn't support them, so your site never stops working.
* Status panel that shows whether the protection is really active.
* Password protected posts keep working for your visitors.
* Manage as many users as you need from the WordPress admin.

**How It Works:**

When someone tries to access the `wp-login.php` page, the server intercepts the request before it reaches the WordPress login screen. At this point, the plugin requires the user to enter an additional `username` and `password`, which are managed by the plugin. If the correct credentials are provided, the user is granted access to the standard WordPress login page. However, if the credentials are incorrect, access is denied, effectively blocking unauthorized attempts and reducing unnecessary server load caused by bot traffic.

**Requirements:**

* Apache or LiteSpeed web server with `.htaccess` support (most shared hosting). On Nginx the plugin shows the configuration you have to add to the server.
* Single site installations (WordPress Multisite is not supported yet).

== Installation ==

1. Install the plugin from the 'Plugins > Add New' screen, or upload the plugin files to the `/wp-content/plugins/protect-wp-login` directory.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. You will be taken to the 'Protect WP Login' page, where the generated username and password are shown. **Save them** before logging out, or create your own users on the same page.

== Frequently Asked Questions ==

= How does Protect WP Login differ from WordPress login credentials? =

The Protect WP Login plugin uses basic authentication via `.htaccess` to protect the login process before the WordPress login screen is displayed, ensuring that unauthorized users are blocked by the server itself, reducing the load on WordPress and the database. In contrast, WordPress login credentials are checked by WordPress after the login page is loaded.

= How do I add a new user? =

Go to the 'Protect WP Login' page under the admin menu, enter a username and password, and click 'Save'.

= How do I delete a user? =

On the same page, find the username you want to delete, and in the 'Actions' column, click 'Delete'.

= I got locked out. How do I get back in? =

Connect to your site by FTP or with the file manager of your hosting, open the `.htaccess` file in the WordPress folder and delete the lines between `# BEGIN Protect WP Login` and `# END Protect WP Login`. You can also rename the `wp-content/plugins/protect-wp-login` folder to deactivate the plugin.

= What happens if my hosting doesn't support it? =

After writing the rules, the plugin checks your site. If the server answers with an error, the rules are removed automatically and the status panel explains what happened, so your site keeps working.

= Does it work on Nginx? =

Nginx doesn't read `.htaccess` files. The plugin page shows the configuration you (or your hosting provider) have to add to the Nginx server to protect `wp-login.php` with the same users.

= Do password protected posts still work? =

Yes. Visitors can still unlock password protected posts and pages without knowing the extra credentials.

= Should I also protect xmlrpc.php? =

If you don't use Jetpack, the WordPress mobile app or another service that publishes through XML-RPC, enabling it blocks another common entry point for brute force attacks.

= Do I need a complex username and password for the authentication prompt? =

No, even with a simple username and password, the plugin blocks unauthorized access attempts before they reach WordPress. This prevents bots from causing unnecessary server load, as they are stopped at the server level without WordPress or the database needing to process the request. The password can't be the same as the username.

= Does the plugin affect website performance? =

No, it actually improves it. By blocking unauthorized access attempts before they reach WordPress, the plugin reduces server load. This leads to fewer database queries and less CPU usage, improving the overall performance of the website.

= Do I need to enter the username and password every time I access the login page? =

Depending on your browser settings, it might store the username and password entered in the authentication prompt. This means that on future visits, the browser can automatically fill in the information, avoiding the need to re-enter it every time.

= What happens if a bot makes multiple incorrect login attempts? =

The plugin works with the server to block these attempts before they reach WordPress. Depending on your server’s security settings, multiple failed attempts may trigger firewall rules that permanently block the attacker’s IP, ensuring no further resource consumption.

= Is my site secure without HTTPS? =

Basic authentication sends the credentials in every request to `wp-login.php`, just like the WordPress login form. Use HTTPS (free with Let's Encrypt on most hosting) to keep them private.

== Screenshots ==

1. **Admin Page** - The Protect WP Login admin interface where you can easily add, manage, and view authentication credentials.
2. **Adding a new user** - Entering a new user and credentials.
3. **User Created Successfully** - Visual confirmation of a newly created user displayed on the admin page.
4. **List of existing users** - View of current users in Protect WP Login.
5. **Server-Level Login Prompt** - Example of the authentication prompt displayed at the server level before accessing the wp-login.php page.
6. **WordPress Login Page** - Once credentials are successfully entered, the user is redirected to the standard WordPress wp-login.php form.
7. **User Deletion** - User successfully deleted, and the updated list is displayed.

== Changelog ==

= 1.1 =
* New: the generated credentials stay visible until you confirm you saved them (before, they disappeared after 60 seconds).
* New: automatic check after writing the rules. If the server returns an error 500, the rules are removed so the site keeps working.
* New: status panel with the protection state and a "Check again" button.
* New: option to also protect xmlrpc.php.
* New: instructions for Nginx servers.
* Fix: password protected posts asked visitors for the extra credentials.
* Fix: passwords with special characters (such as < or %) were changed before being saved.
* Fix: the rules were duplicated when reactivating the plugin, and were not removed from .htaccess files with Windows line endings.
* Fix: uninstalling the plugin now also removes the rules from .htaccess.
* Fix: the global ErrorDocument 401/403 rules no longer affect the rest of the site.
* Security: web access to the folder that stores the password file is now blocked.
* Improvement: the plugin no longer touches the file system on every page load.
* Tested with WordPress 7.1 and PHP 8.2.

= 1.0 =
* Initial release.

== Upgrade Notice ==

= 1.1 =
Fixes password protected posts, safer .htaccess handling with automatic rollback, and credentials that no longer disappear after activation. Your existing users are kept.
