Description
Blog Cutter Smart Security Management is a local WordPress security helper. It stays on your site: it does not phone home, load remote scripts, or use a third-party threat feed.
The plugin can:
- Show a simple math challenge to suspicious guests, rate-limited browsers, or 404 probes
- Rate-limit unique URLs per IP and log the event
- Add a math check and lockout to the login form
- Hide wp-login.php behind a secret slug (optional)
- Protect comments and user registration with a math check and honeypot
- Offer optional TOTP two-factor authentication from the user profile (authenticator app, no SaaS)
- Apply common hardening: hide the generator tag, disable XML-RPC, block user enumeration, send security headers
- Block common exploit probes in the request URI (local pattern list)
- Store security events (IP, user agent, URL) in your database for a limited time
- Run a local health checklist and let administrators revoke sessions
This plugin helps reduce automated attacks. It cannot guarantee that a site will never be compromised. Keep WordPress, themes, and plugins updated, use strong unique passwords, and take regular backups.
How to configure
- After activation, open Blog Cutter Security in the admin menu.
- Review Settings. Defaults are conservative for new installs (anonymous REST lockdown and HSTS are off).
- Optional: enable two-factor authentication on each administrator Profile.
- Optional: Magic Login — send a test email first, then enable the one-time link. Opening the link requires a confirm click so email scanners cannot sign anyone in.
- If you hide the login URL, bookmark the secret slug. Locked out? Add
define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true );to wp-config.php, or deactivate the plugin over FTP / file manager.
Privacy
When logging is enabled, the plugin stores IP addresses, user agents, requested URLs, and short event details in a table on this site. Data is not sent to the plugin author. Suggested privacy-policy text is added under Tools Privacy. Personal data export and erase callbacks are registered. Email is used only when an administrator enables magic login, login alerts, or the weekly digest.
Third-party services
None. Reverse-DNS crawler verification (optional) uses the server’s DNS resolver only.
Screenshots
Installation
- Upload the
blog-cutter-smart-security-managementfolder to/wp-content/plugins/ - Activate Blog Cutter Smart Security Management
- Open Blog Cutter Security and review Settings, Health, and Logs
- Enable two-factor authentication from your Profile if you want it
FAQ
-
Will search engines still index the site?
-
Trusted crawler user agents can skip the visitor gate. Optional reverse-DNS verification is available for stricter checks.
-
Can I require a challenge for every guest?
-
Yes. Set Gate mode to “Always challenge guests”.
-
Why is REST lockdown off by default?
-
Locking the REST API for anonymous users can break forms, blocks, and shopfronts. Enable it only if you have tested those features.
-
Does this plugin update itself from another server?
-
No. Updates should come from WordPress.org after the plugin is hosted there, or from the zip you install.
-
I hid the login URL and cannot sign in
-
Add
define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true );to wp-config.php, or deactivate the plugin over FTP / file manager.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Blog Cutter Smart Security Management” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Blog Cutter Smart Security Management” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.1.4
- Prevent early translation loading notice in WordPress 6.7+ by moving cron scheduling to the init hook
- Guarded cron_schedules display text to avoid calling translation functions before the init hook
- Guarded early firewall block messages against early translation calls
2.1.3
- Resolved activation fatal error by ensuring BLOGCUSM_Uploads::ensure_uploads_rules() is defined
- Safely preserves and appends existing rules in uploads/.htaccess using WordPress core markers (insert_with_markers)
- Cleans up plugin rules and markers upon deactivation and uninstall
2.1.2
- Removed standalone emergency unlock helper file in compliance with directory guidelines
- Removed disallow_file_mods setting to ensure uninterrupted WordPress core and plugin updates
- Replaced runtime secret login define with static request state
- Added file extension validation for settings JSON import
- Added HTML escaping for challenge fields
2.1.1
- Replaced runtime constant defines (DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS) with WordPress core map_meta_cap and file_mod_allowed filters
- Comprehensive input sanitization and validation across $_SERVER, $_POST, and $_FILES arrays
- Safe settings import using WordPress core wp_json_file_decode
2.1.0
- Unique 8-character plugin prefix, nonce checks on form handlers, and admin notices limited to plugin/profile screens
2.0.0
- Aligned headers, readme, and copy with WordPress.org plugin guidelines
- Added local TOTP two-factor authentication, health checks, session revocation, and GDPR export/erase
- Added registration and password-reset protection, optional login alerts, and settings export/import
- Safer defaults for anonymous REST lockdown, application passwords, and HSTS
- Magic login now requires a confirm click; emergency unlock no longer disables other plugins
- Challenge tokens no longer use Base64; styles are printed through WordPress APIs
1.1.1
- Hidden login, WAF, and hardening updates
1.0.0
- Initial release