Title: Aegis User Guard Author: Ahnaf007 Published: September 25, 2026 Last modified: September 26, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/aegis-user-guard.svg) # Aegis User Guard By [Ahnaf007](https://profiles.wordpress.org/wp_shibly/) [Download](https://downloads.wordpress.org/plugin/aegis-user-guard.1.3.2.zip) * [Details](https://wordpress.org/plugins/aegis-user-guard/#description) * [Reviews](https://wordpress.org/plugins/aegis-user-guard/#reviews) * [Installation](https://wordpress.org/plugins/aegis-user-guard/#installation) * [Development](https://wordpress.org/plugins/aegis-user-guard/#developers) [Support](https://wordpress.org/support/plugin/aegis-user-guard/) ## Description Aegis User Guard is a single, self-contained security console that adds the identity- policy controls most sites end up needing eventually: password expiration and complexity, inactivity lockout, brute-force protection, two-factor authentication, an IP allow/ block list, and full oversight of every Administrator account. It does not replace WordPress’s login system or session handling; it layers policy and visibility on top of it, and every control can be switched off independently. Everything lives on one native-feeling admin screen, organized into tabs: * **Core controls** — the identity policies below, each with its own on/off switch. * **Recently added** — a quick pulse of the newest accounts and their status. * **Email notifications** — the shared template and recipient list for Administrator security alerts. * **Administrator directory** — every Administrator, their last sign-in, active sessions, and one-click actions. * **Access & IPs** — a manual IP allow/block list. * **Checklist** — a read-only audit of common WordPress hardening gaps, with one- click fixes where Aegis can apply them. * **Activity log** — a chronological, exportable record of every security event Aegis observed. #### Identity policies * **Password freshness** — prompt users to rotate their password after a configurable age (default 180 days). * **Password complexity** — require a minimum length and, optionally, mixed case, a number, and a symbol, enforced on password reset and profile changes. * **Inactive account lockout** — pause login access after a configurable period of inactivity (default 90 days). * **Brute-force lockout** — lock an account and its originating network after repeated failed sign-ins, independent of whether the attempted username exists. * **Two-factor authentication (TOTP)** — self-service setup from any user’s own profile (manual-entry key, no third-party QR service), with one-time backup codes and an option to require it for all Administrators. * **REST API user-list restriction** — block anonymous requests to `/wp-json/wp/ v2/users` so usernames cannot be enumerated, while leaving authenticated requests untouched. * **Administrator alerts** — independently alert all or selected Administrators when a user is created, signs in, changes username, changes email address, or changes password. Administrator promotions remain covered as well. * **New-device sign-in alerts** — email a user when their own account signs in from an IP address not seen before. #### Administrator oversight * A live directory of every Administrator account: last sign-in, status, active session count, and CSV export. * Manual Pause access / Reactivate access for any account, with native WordPress session termination. * A “Force password reset” action that requires a new password on next login and signs the account out everywhere. * A one-click “Sign out everywhere” action to end every active session for an account immediately. * A pending-Administrator review queue: new or newly promoted Administrators are blocked from signing in until an existing Administrator grants access. #### Access control * A manual IP allow/block list — block a network outright, or exempt a trusted IP from brute-force lockouts. * Individual failed-sign-in logging, alongside every lockout, pause, and policy change, in the Activity log. #### Hardening checklist A read-only audit covering file-editing access, debug output exposure, HTTPS on wp-admin, a default “admin” username, the two-factor requirement, REST API user enumeration, and pending core/plugin updates — each with a plain-language fix, and a direct link into the relevant Aegis setting where Aegis can apply it itself. #### Everything native Aegis stores its data in standard WordPress options and user meta, uses native password- reset and session-termination APIs, and never introduces its own authentication layer. Disabling or deleting the plugin returns the site to stock WordPress behavior. ### Features * Configurable password-expiration policy (default 180 days). * Configurable password-complexity policy (length, case, number, symbol). * Configurable inactivity lockout (default 90 days). * Configurable brute-force lockout, per account and per originating network. * Optional two-factor authentication (TOTP) with one-time backup codes, self-service from each user’s own profile. * Optional REST API restriction to stop anonymous username enumeration via `/wp- json/wp/v2/users`. * Event-level Administrator email alerts for account creation, successful sign- in, username, email, and password changes, with selectable recipients and a shared editable template. * Optional email alert to a user on sign-in from a new IP address. * Pending-Administrator review queue for new or newly promoted Administrators. * Administrator directory with last sign-in, live session counts, and CSV export. * “Force password reset” and “Sign out everywhere” actions for any account. * Security status column and manual Pause access / Reactivate access on the Users screen. * Manual IP allow/block list. * Read-only security hardening checklist with one-click fixes. * Chronological, searchable, exportable Activity log. * A single top-level, native-feeling WordPress admin screen — no external APIs are required for Aegis’s security controls, and the optional Gravatar avatar lookup is documented below. ### External services This plugin optionally uses the Gravatar service, operated by Automattic, to display profile images for Administrators in the Administrator directory. Gravatar is not required for Aegis’s security controls; the plugin displays its bundled placeholder image if a Gravatar image is unavailable. When an Administrator directory is opened and WordPress has a Gravatar URL for an Administrator, the visitor’s browser requests the image from `secure.gravatar.com`( or the Gravatar URL returned by the site’s WordPress configuration). The request URL contains a hash of the Administrator’s normalized email address so Gravatar can select the associated image. The browser also sends normal HTTP request information, such as its IP address and user-agent, to the service. The request is made only to load that optional avatar image; Aegis does not send the Administrator’s raw email address to Gravatar. Gravatar is provided by Automattic. See Gravatar’s [Terms of Service](https://wordpress.com/tos/) and [Privacy Policy](https://automattic.com/privacy/) for information about the service’s terms and data handling. ## Screenshots [⌊Core controls for password, inactivity, brute-force, and two-factor policies.⌉⌊ Core controls for password, inactivity, brute-force, and two-factor policies.⌉[ Core controls for password, inactivity, brute-force, and two-factor policies. [⌊Chronological Activity log with searchable security events.⌉⌊Chronological Activity log with searchable security events.⌉[ Chronological Activity log with searchable security events. [⌊Access IP rules for allow/block policy management.⌉⌊Access IP rules for allow/ block policy management.⌉[ Access IP rules for allow/block policy management. [⌊Configurable Administrator email notifications and recipients.⌉⌊Configurable Administrator email notifications and recipients.⌉[ Configurable Administrator email notifications and recipients. [⌊Users status view with account access and security state.⌉⌊Users status view with account access and security state.⌉[ Users status view with account access and security state. [⌊Recently added Administrator accounts awaiting review.⌉⌊Recently added Administrator accounts awaiting review.⌉[ Recently added Administrator accounts awaiting review. [⌊Administrator directory with sign-in, session, and access details.⌉⌊Administrator directory with sign-in, session, and access details.⌉[ Administrator directory with sign-in, session, and access details. [⌊Read-only security hardening checklist with actionable fixes.⌉⌊Read-only security hardening checklist with actionable fixes.⌉[ Read-only security hardening checklist with actionable fixes. ## Installation 1. Upload the `aegis-user-guard` folder to `wp-content/plugins/`, or upload the plugin ZIP from Plugins > Add New > Upload Plugin. 2. Activate Aegis User Guard from the Plugins screen. 3. Open the Aegis User Guard menu item in the main admin sidebar to review the default policies and adjust them to your site. 4. Use the Administrator directory tab, or Users > All Users, for per-account status and manual access controls. ## FAQ ### Does this replace WordPress’s login system? No. Aegis adds policy checks and visibility on top of native WordPress authentication, session handling, and password reset — it does not introduce its own login form, session store, or password hashing. ### What happens to existing accounts when I activate the plugin? Nothing changes immediately. Accounts are initialized with current timestamps on their next successful login, so no one is locked out by policies that were not in effect when they last signed in. ### Does two-factor authentication use a third-party service? No. Setup uses a manual-entry secret key compatible with any standard TOTP authenticator app (Google Authenticator, Authy, 1Password, etc.); no QR code service or external API is involved. ### What does “Sign out everywhere” actually do? It destroys every active WordPress session token for that account using the native session-token API, the same mechanism behind core’s own “Log Out Everywhere Else.” ### Does disabling a policy delete its saved settings? No. Turning a rule’s “Enforce rule” switch off keeps its configured value (days, attempts, minimum length, etc.) saved and simply stops it from being evaluated at login until you turn it back on. ### Is any data sent off-site? Aegis stores its settings and activity log in standard WordPress options and user meta on your own database. Email notifications are sent through your site’s normal` wp_mail()` configuration. If the Administrator directory displays a Gravatar avatar, the visitor’s browser also requests that image from Gravatar as described in the External services section above. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Aegis User Guard” is open source software. The following people have contributed to this plugin. Contributors * [ Ahnaf007 ](https://profiles.wordpress.org/wp_shibly/) [Translate “Aegis User Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/aegis-user-guard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/aegis-user-guard/), check out the [SVN repository](https://plugins.svn.wordpress.org/aegis-user-guard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/aegis-user-guard/) by [RSS](https://plugins.trac.wordpress.org/log/aegis-user-guard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.3.2 * Documented the optional Gravatar avatar service, its data transfer conditions, and its legal links. #### 1.3.1 * Removed admin notice suppression so native WordPress and other plugin notices remain visible. * Removed inline admin style and script output and tightened request-validation ordering. * Updated plugin contributor metadata for the WordPress.org owner account. #### 1.3.0 * Refactored the plugin bootstrap and core class structure for WordPress coding standards compliance. * Added complete PHPDoc coverage and improved translation annotations across the PHP codebase. * Improved output escaping, native WordPress hook handling, and standards-compliant input processing. * Consolidated the packaged HTML documentation and retina screenshots under the` documentation` folder. #### 1.2.0 * Added WPML compatibility metadata for translating saved Administrator email subject and message settings. * Localized dynamic admin JavaScript dialogs, validation messages, pagination, notification emails, and CSV exports. * Added locale-aware notification email markup and completed the translation coverage for the plugin’s runtime interface. #### 1.1.0 * Added five independently configurable Administrator alert events for account creation, successful sign-in, username changes, email changes, and password changes. * Extended the Email notifications template and recipient settings to every Administrator alert event. * Added a responsive event-selection interface to Core controls. #### 1.0.0 * Initial release. ## Meta * Version **1.3.2** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Tags * [login security](https://wordpress.org/plugins/tags/login-security/)[password policy](https://wordpress.org/plugins/tags/password-policy/) [security](https://wordpress.org/plugins/tags/security/)[two factor authentication](https://wordpress.org/plugins/tags/two-factor-authentication/) [user management](https://wordpress.org/plugins/tags/user-management/) * [Advanced View](https://wordpress.org/plugins/aegis-user-guard/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/aegis-user-guard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/aegis-user-guard/reviews/) ## Contributors * [ Ahnaf007 ](https://profiles.wordpress.org/wp_shibly/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/aegis-user-guard/)