Title: Blog Cutter Smart Security Management Author: Blog Cutter AI Published: October 12, 2026 Last modified: October 12, 2026 --- Search plugins ![](https://ps.w.org/blog-cutter-smart-security-management/assets/banner-772x250. png?rev=3741791) ![](https://ps.w.org/blog-cutter-smart-security-management/assets/icon-256x256.png? rev=3741791) # Blog Cutter Smart Security Management By [Blog Cutter AI](https://profiles.wordpress.org/blgctterai/) [Download](https://downloads.wordpress.org/plugin/blog-cutter-smart-security-management.zip) * [Details](https://wordpress.org/plugins/blog-cutter-smart-security-management/#description) * [Reviews](https://wordpress.org/plugins/blog-cutter-smart-security-management/#reviews) * [Installation](https://wordpress.org/plugins/blog-cutter-smart-security-management/#installation) * [Development](https://wordpress.org/plugins/blog-cutter-smart-security-management/#developers) [Support](https://wordpress.org/support/plugin/blog-cutter-smart-security-management/) ## Description Blog Cutter Smart Security Management is a local WordPress security helper. It stays on your site: it does not phone home, load remote scripts, or use a third-party threat feed. The plugin can: * Show a simple math challenge to suspicious guests, rate-limited browsers, or 404 probes * Rate-limit unique URLs per IP and log the event * Add a math check and lockout to the login form * Hide wp-login.php behind a secret slug (optional) * Protect comments and user registration with a math check and honeypot * Offer optional TOTP two-factor authentication from the user profile (authenticator app, no SaaS) * Apply common hardening: hide the generator tag, disable XML-RPC, block user enumeration, send security headers * Block common exploit probes in the request URI (local pattern list) * Store security events (IP, user agent, URL) in your database for a limited time * Run a local health checklist and let administrators revoke sessions This plugin helps reduce automated attacks. It cannot guarantee that a site will never be compromised. Keep WordPress, themes, and plugins updated, use strong unique passwords, and take regular backups. #### How to configure 1. After activation, open **Blog Cutter Security** in the admin menu. 2. Review **Settings**. Defaults are conservative for new installs (anonymous REST lockdown and HSTS are off). 3. Optional: enable two-factor authentication on each administrator **Profile**. 4. Optional: **Magic Login** — send a test email first, then enable the one-time link. Opening the link requires a confirm click so email scanners cannot sign anyone in. 5. If you hide the login URL, bookmark the secret slug. Locked out? Add `define( ' BLOGCUSM_DISABLE_HIDE_LOGIN', true );` to wp-config.php, or deactivate the plugin over FTP / file manager. #### Privacy When logging is enabled, the plugin stores IP addresses, user agents, requested URLs, and short event details in a table on this site. Data is not sent to the plugin author. Suggested privacy-policy text is added under Tools Privacy. Personal data export and erase callbacks are registered. Email is used only when an administrator enables magic login, login alerts, or the weekly digest. #### Third-party services None. Reverse-DNS crawler verification (optional) uses the server’s DNS resolver only. ## Screenshots [⌊The dashboard shows protection status and events from the last 24 hours.⌉⌊The dashboard shows protection status and events from the last 24 hours.⌉[ The dashboard shows protection status and events from the last 24 hours. [⌊Settings for the visitor gate, rate limiting, login shield, comments, crawlers, firewall, hardening, and two-factor authentication.⌉⌊Settings for the visitor gate, rate limiting, login shield, comments, crawlers, firewall, hardening, and two-factor authentication.⌉[ Settings for the visitor gate, rate limiting, login shield, comments, crawlers, firewall, hardening, and two-factor authentication. [⌊Security logs stay in your database. Filter them and export a CSV.⌉⌊Security logs stay in your database. Filter them and export a CSV.⌉[ Security logs stay in your database. Filter them and export a CSV. [⌊Magic login stays locked until an email delivery test succeeds.⌉⌊Magic login stays locked until an email delivery test succeeds.⌉[ Magic login stays locked until an email delivery test succeeds. [⌊The health screen runs local checks and does not contact a remote service.⌉⌊The health screen runs local checks and does not contact a remote service.⌉[ The health screen runs local checks and does not contact a remote service. [⌊Administrators can review and revoke active sessions.⌉⌊Administrators can review and revoke active sessions.⌉[ Administrators can review and revoke active sessions. ## Installation 1. Upload the `blog-cutter-smart-security-management` folder to `/wp-content/plugins/` 2. Activate **Blog Cutter Smart Security Management** 3. Open **Blog Cutter Security** and review Settings, Health, and Logs 4. Enable two-factor authentication from your Profile if you want it ## FAQ ### Will search engines still index the site? Trusted crawler user agents can skip the visitor gate. Optional reverse-DNS verification is available for stricter checks. ### Can I require a challenge for every guest? Yes. Set Gate mode to “Always challenge guests”. ### Why is REST lockdown off by default? Locking the REST API for anonymous users can break forms, blocks, and shopfronts. Enable it only if you have tested those features. ### Does this plugin update itself from another server? No. Updates should come from WordPress.org after the plugin is hosted there, or from the zip you install. ### I hid the login URL and cannot sign in Add `define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true );` to wp-config.php, or deactivate the plugin over FTP / file manager. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Blog Cutter Smart Security Management” is open source software. The following people have contributed to this plugin. Contributors * [ Blog Cutter AI ](https://profiles.wordpress.org/blgctterai/) [Translate “Blog Cutter Smart Security Management” into your language.](https://translate.wordpress.org/projects/wp-plugins/blog-cutter-smart-security-management) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/blog-cutter-smart-security-management/), check out the [SVN repository](https://plugins.svn.wordpress.org/blog-cutter-smart-security-management/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/blog-cutter-smart-security-management/) by [RSS](https://plugins.trac.wordpress.org/log/blog-cutter-smart-security-management/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.1.4 * Prevent early translation loading notice in WordPress 6.7+ by moving cron scheduling to the init hook * Guarded cron_schedules display text to avoid calling translation functions before the init hook * Guarded early firewall block messages against early translation calls #### 2.1.3 * Resolved activation fatal error by ensuring BLOGCUSM_Uploads::ensure_uploads_rules() is defined * Safely preserves and appends existing rules in uploads/.htaccess using WordPress core markers (insert_with_markers) * Cleans up plugin rules and markers upon deactivation and uninstall #### 2.1.2 * Removed standalone emergency unlock helper file in compliance with directory guidelines * Removed disallow_file_mods setting to ensure uninterrupted WordPress core and plugin updates * Replaced runtime secret login define with static request state * Added file extension validation for settings JSON import * Added HTML escaping for challenge fields #### 2.1.1 * Replaced runtime constant defines (DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS) with WordPress core map_meta_cap and file_mod_allowed filters * Comprehensive input sanitization and validation across $_SERVER, $_POST, and $_FILES arrays * Safe settings import using WordPress core wp_json_file_decode #### 2.1.0 * Unique 8-character plugin prefix, nonce checks on form handlers, and admin notices limited to plugin/profile screens #### 2.0.0 * Aligned headers, readme, and copy with WordPress.org plugin guidelines * Added local TOTP two-factor authentication, health checks, session revocation, and GDPR export/erase * Added registration and password-reset protection, optional login alerts, and settings export/import * Safer defaults for anonymous REST lockdown, application passwords, and HSTS * Magic login now requires a confirm click; emergency unlock no longer disables other plugins * Challenge tokens no longer use Base64; styles are printed through WordPress APIs #### 1.1.1 * Hidden login, WAF, and hardening updates #### 1.0.0 * Initial release ## Meta * Version **2.1.4** * Last updated **3 days ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [2FA](https://wordpress.org/plugins/tags/2fa/)[captcha](https://wordpress.org/plugins/tags/captcha/) [firewall](https://wordpress.org/plugins/tags/firewall/)[login](https://wordpress.org/plugins/tags/login/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/blog-cutter-smart-security-management/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/blog-cutter-smart-security-management/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/blog-cutter-smart-security-management/reviews/) ## Contributors * [ Blog Cutter AI ](https://profiles.wordpress.org/blgctterai/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/blog-cutter-smart-security-management/)