Description
Allimedia Login & Prefix Guard combines two focused hardening workflows: a private login URL that reduces automated login noise and a controlled database table prefix changer for sites that still use a predictable prefix such as wp_.
Unlike a login-only URL hider, the plugin treats a database prefix change as a verified workflow. It checks the installation before making changes, maps core and custom tables, validates metadata and collisions, coordinates wp-config.php with the database operation, verifies the resulting site state and automatically rolls back if any post-change integrity check fails.
The plugin is intentionally small: no tracking, no external services, no remote assets, no ads, and no public “powered by” links.
Main features
- Hide direct requests to wp-login.php and wp-admin from logged-out visitors with a 404 response.
- Set a private custom login slug from the WordPress admin.
- Generate a random login slug automatically on new installations.
- Generate a new random login slug from the settings screen.
- Update WordPress login, logout, registration and lost password links.
- Rename database tables from the current prefix to a new prefix.
- Generate a random database prefix when you do not want to choose one manually.
- Run a readiness check before changing the prefix, including core table completeness, metadata collisions, database privileges, wp-config.php status and in-memory rollback readiness.
- Preview the complete impact map and distinguish WordPress core tables from plugin or custom tables.
- Update related user role and usermeta keys during the prefix change.
- Verify every renamed table, wp-config.php, role metadata, user capabilities, site URL data and the active WordPress prefix after the operation.
- Automatically restore the original tables, metadata and wp-config.php when any post-change integrity check fails.
- Show a one-time post-change integrity report to the administrator.
- Retain the original wp-config.php content only in memory during the synchronous operation; no configuration backup is stored on disk.
- Require administrator permission, nonce verification and backup confirmation before database changes.
- Copy the custom login URL from the settings screen.
- Use WP-CLI commands for prefix generation, preview and change.
Important backup notice
Changing the database table prefix is a sensitive maintenance task. Always create a full database backup and an external wp-config.php backup before using the prefix changer. The plugin does not create a database backup and does not store a wp-config.php backup anywhere on disk. The original configuration is retained only in memory for an automatic rollback during the synchronous operation.
Privacy
Allimedia Login & Prefix Guard does not collect personal data, does not contact external servers and does not add tracking scripts.
Languages
The plugin is fully internationalized. Community translations are managed and delivered through translate.wordpress.org.
Screenshots
Installation
- Upload the plugin folder to
/wp-content/plugins/allimedia-login-prefix-guard/. - Activate the plugin through the Plugins screen in WordPress.
- Go to Settings > Allimedia Login & Prefix Guard.
- Set your custom login slug and enable login protection.
- Save the new login URL in a secure place before logging out.
FAQ
-
Will this change WordPress core files?
-
No. The plugin does not edit WordPress core files. The database prefix tool updates database table names and wp-config.php only after an administrator explicitly confirms the action.
-
How is this different from a login-only URL hider?
-
Login URL protection is one half of the plugin. The second core workflow treats a database prefix change as a verified operation with a readiness report, core/custom table impact map, identifier and metadata collision validation, post-change integrity verification, coordinated wp-config.php handling and verified automatic rollback.
-
Can I use the prefix changer on multisite?
-
No. Prefix changing is disabled on multisite installations because table mapping is more complex and should be handled manually by an experienced administrator.
-
What happens to wp-login.php?
-
When login protection is enabled, direct requests to wp-login.php return a 404 response. WordPress login links are changed to your custom login slug.
-
What happens when a logged-out visitor opens wp-admin?
-
The request returns a 404 response instead of redirecting to and revealing the custom login URL. Public endpoints required by WordPress and plugins remain available.
-
What should I do before changing the database prefix?
-
Create a full database backup and a wp-config.php backup. Also make sure you have filesystem or hosting panel access in case you need to restore the site.
-
Can I preview the prefix change first?
-
Yes. Use the Preview prefix change button to see every planned rename and a readiness report covering core tables, custom tables, WordPress metadata, collisions, wp-config.php, in-memory rollback readiness and database privileges. A failed readiness check blocks the operation.
-
Does the plugin include WP-CLI commands?
-
Yes. Use
wp login-prefix-guard generate,wp login-prefix-guard preview newprefix_andwp login-prefix-guard change newprefix_ --confirm-backup --yes. -
Does the plugin send data to Allimedia.cz or any third party?
-
No. The plugin does not send data to external servers.
-
How do I enable Czech?
-
Set the WordPress site language or your user profile language to Czech. The plugin interface will switch automatically.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Allimedia Login & Prefix Guard” is open source software. The following people have contributed to this plugin.
Contributors
“Allimedia Login & Prefix Guard” has been translated into 1 locale. Thank you to the translators for their contributions.
Translate “Allimedia Login & Prefix Guard” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.2
- Removed all on-disk wp-config.php rollback copies; the original content is retained only in memory during the operation.
- Initialized file access through the standard WordPress Filesystem API.
- Simplified configuration rollback and clarified escaped administrator output.
1.1.1
- Fixed activation when migrating from the legacy login-prefix-guard plugin folder.
- Automatically deactivated the loaded legacy copy before activating the WordPress.org-slugged package.
- Added an administrator notice identifying the old plugin folder that can be removed after verification.
1.1.0
- Added a database prefix readiness report with seven checks before any table is changed.
- Added an impact map that distinguishes WordPress core tables from plugin and custom tables.
- Added six post-change integrity checks covering table names, wp-config.php, roles, user capabilities, site URL data and the active WordPress database prefix.
- Added verified automatic rollback when any post-change integrity check fails.
- Added one-time integrity reports in wp-admin and expanded WP-CLI readiness output.
1.0.15
- Replaced persistent wp-config.php backups with protected, non-executable temporary rollback copies inside the runtime uploads directory.
- Removed every temporary rollback copy after successful completion or rollback and verified wp-config.php writes and restores.
- Switched configuration file operations to the WordPress Filesystem API.
- Removed bundled translation files in favor of translate.wordpress.org delivery.
- Clarified the distinct database-prefix workflow in the plugin description and FAQ.
1.0.14
- Added the official Allimedia product and author metadata.
- Migrated the translation domain and distribution package to the allimedia-login-prefix-guard WordPress.org slug.
- Aligned the main plugin filename with the distribution slug.
- Preserved existing settings, the admin page URL and WP-CLI command for backward compatibility.
1.0.13
- Updated WordPress compatibility metadata for WordPress 7.1.
- Loaded the custom login after WordPress initialization and initialized core login globals.
- Avoided loading the active theme while blocking logged-out wp-admin requests.
- Added preflight validation for invalid or overly long database table names.
- Updated prefixed usermeta keys without replacing later text matches.
- Cleared role and user metadata caches after a prefix change.
- Synchronized the active WordPress database connection after table renaming.
- Added a bundled user manual and Help link.
1.0.12
- Renamed the public plugin name to start with the Allimedia brand for WordPress.org naming compliance.
1.0.11
- Added safer rollback handling for partially failed database prefix metadata updates.
- Report incomplete automatic rollback when wp-config.php cannot be updated after table renaming.
- Updated release metadata in bundled translation files.
1.0.10
- Reworked table-prefix SQL statements to use prepared %i identifier placeholders.
- Updated compatibility metadata to WordPress 7.0.
1.0.9
- Fixed WordPress.org plugin-check findings around prefix file writability checks, nonce-verified admin messages and discouraged textdomain loading.
- Documented intentional direct database operations needed for table prefix changes with validated identifiers.
1.0.8
- Added a protected wp-content fallback when the parent WordPress directory cannot be used for wp-config.php backups.
- Checked backup directory protection files before accepting a backup directory.
1.0.7
- Added a random token to wp-config.php backup filenames.
- Added consistent file locking when creating backup directory protection files.
1.0.6
- Fixed parent-directory path handling for wp-config.php and backup storage.
- Added a protected backup-file prelude.
- Localized WP-CLI output.
- Clarified that the plugin does not create a database backup.
1.0.5
- Moved wp-config.php backups outside ABSPATH and stopped exposing full backup paths in admin notices.
- Fixed table collision checks for underscores in MySQL LIKE patterns.
- Added stricter prefix validation and stronger confirmation before changing the database prefix.
- Registered WP-CLI commands on cli_init and added –yes for prefix changes.
- Removed double URL encoding in admin redirect messages.
- Expanded reserved login slug checks.
1.0.4
- Added a random default login slug for new installations.
- Added a login URL generator for existing installations.
- Added bundled Czech translation.
1.0.3
- Prevented wp-admin from revealing the custom login URL to logged-out visitors.
- Preserved public admin AJAX, form action and asset endpoints.
1.0.2
- Added stricter PHP declarations.
- Added deferred admin script loading.
- Added project .gitignore.
- Added release checks for UTF-8 BOM and ZIP paths.
1.0.1
- Added random prefix generator.
- Added prefix change dry run preview.
- Added custom login URL copy button.
- Added one-time recovery guidance after enabling login protection.
- Added WP-CLI commands for generate, preview and change.
1.0.0
- Initial release.