=== IC Security Guard ===
Contributors: itclanbd
Tags: security, login security, hide login, brute force, login lockout
Requires at least: 6.5
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Keep your website secure from attackers by hiding your login page and locking out brute force login attempts.

== Description ==

IC Security Guard is a lightweight security hardening plugin that protects your WordPress site from brute force login attacks and keeps your default login page hidden from attackers.

Instead of leaving `wp-login.php` and `/wp-admin` open for anyone to find and attack, IC Security Guard lets you move your login page to a custom, secret URL and automatically locks out anyone who fails to log in too many times — even if they eventually guess the right password during a lockout.

= Special Features =

* Hide the default `wp-login.php` and `/wp-admin` login pages from unauthenticated visitors
* Serve the login form only on a custom, secret URL that you choose
* Redirect anyone hitting the default login URL to a page of your choice, or a plain 404
* Limit failed login attempts with a configurable maximum
* Automatic lockout for a configurable duration after too many failed attempts
* Live countdown timer shown on the login form while locked out
* Lockout state persists across page reloads and resets automatically once it expires
* Logged-in users always pass through untouched — no impact on legitimate access

== Installation ==

1. Upload the `wp-security` folder to the `/wp-content/plugins/` directory, or install the plugin directly through the WordPress Plugins screen.
2. Activate the plugin through the "Plugins" screen in WordPress.
3. Go to **Settings → IC Security Guard** to configure the plugin.
4. On the **General Settings** tab, enable login attempt limiting and set your maximum failed attempts and lockout duration.
5. On the **Hide Default Logged-in** tab, enable "Hide Default Login Pages", set your new secret login slug, and optionally set a redirect target for blocked visitors.
6. Save your changes and bookmark your new login URL before logging out.

== Frequently Asked Questions ==

= What happens if I forget my new login URL? =

You can always reach your site's database (via phpMyAdmin or your host) and update the `wp_bfs_hidelogin_options` option in the `wp_options` table to disable `hide_login_url`, restoring access to the default `wp-login.php`.

= Will this lock me out of my own site? =

Logged-in users are always allowed through to `/wp-admin` regardless of the hidden login setting. The failed-login lockout only applies to failed authentication attempts, and resets automatically once the configured lockout duration passes.

= Does this plugin affect logged-in users? =

No. Logged-in users pass through untouched. The hidden login and lockout logic only applies to unauthenticated visitors and failed login attempts.

= Where is the lockout state stored? =

Lockout state is stored per IP address using WordPress transients, so it persists across page reloads and works with whatever caching layer your site already uses.

= Is XML-RPC or .htaccess/wp-config hardening included? =

Those sections are currently marked "Coming soon" in the plugin settings and will be added in a future release.

== Screenshots ==

1. Backend settings
2. Change Login Url
3. Readme

== Changelog ==

= 1.0.0 =
* Initial release.
* Hide default login page and serve login only on a custom URL.
* Configurable failed login attempt limiting with automatic lockout.
* Live countdown timer on the login form during lockout.

== Upgrade Notice ==

= 1.0.0 =
Initial release of IC Security Guard.
