Title: KHALAF Login Access Guard Author: Ahmed Khalaf Published: September 24, 2026 Last modified: September 24, 2026 --- Search plugins This plugin **hasn’t been tested with the latest 3 major releases of WordPress**. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress. ![](https://ps.w.org/khalaf-login-access-guard/assets/icon-256x256.png?rev=3710611) # KHALAF Login Access Guard By [Ahmed Khalaf](https://profiles.wordpress.org/khalaf22/) [Download](https://downloads.wordpress.org/plugin/khalaf-login-access-guard.1.0.0.zip) * [Details](https://wordpress.org/plugins/khalaf-login-access-guard/#description) * [Reviews](https://wordpress.org/plugins/khalaf-login-access-guard/#reviews) * [Installation](https://wordpress.org/plugins/khalaf-login-access-guard/#installation) * [Development](https://wordpress.org/plugins/khalaf-login-access-guard/#developers) [Support](https://wordpress.org/support/plugin/khalaf-login-access-guard/) ## Description **KHALAF Login Access Guard** defends your WordPress website against automated bots, brute-force attacks, and credential stuffing by transforming the standard `/wp-login. php` path into a private, customizable URL of your choice. Unlike typical hide-login plugins that simply display a generic 404 error or a blank screen, **KHALAF Login Access Guard** provides a dedicated visual customizer and a real-time live preview inside your dashboard to design a modern, branded 403 Access Denied page for blocked visitors. #### Key Features * **Custom Secret Login URL**: Move `/wp-login.php` to any custom slug (e.g. `/ my-secret-door`). * **Visual Access Denied Customizer**: Full control over background gradients/colors, card border radius, shadows, padding, icons, typography, and button styling. * **Interactive Live Preview**: Preview your custom 403 Forbidden page in real time directly from the admin settings before publishing. * **Dual-Language & RTL Ready**: Native support for Arabic and English with seamless RTL (right-to-left) typography and layout switching. * **XML-RPC Attack Defense**: Optional toggle to block automated attacks targeting` xmlrpc.php`. * **Zero Disruption to Core Actions**: Password recovery links with secure reset tokens, logout, privacy confirmations, and protected post actions continue working seamlessly. * **Safe Redirect Option**: Option to redirect unauthorized attempts to any custom URL on your domain instead of rendering the denied page. * **One-Click Toggle**: Activate or deactivate protection anytime without losing your customized design or settings. * **Cryptographic Slug Generator**: Generate secure, randomized login slugs using browser cryptographic randomness with one click. * **Non-Intrusive Admin Notices**: Dismissible dashboard reminders compliant with WordPress Guidelines. #### Security Notes * The plugin does **not** alter the WordPress admin dashboard (`/wp-admin`). Once logged in, administrators and authors work normally. * Hiding your login URL provides a strong layer of defense against automated scanning bots, but should be combined with strong passwords and 2FA. * The redirect option restricts destination targets to the same site domain to eliminate open-redirect vulnerabilities. * Reserved system slugs (`wp-admin`, `admin`, `login`, `xmlrpc`, `wp-json`, etc.) are blocked from being set as the login slug. * All settings and requests are sanitized, validated, and escaped following WordPress coding standards. ## Screenshots [⌊General configuration tab with secret slug generator and copy-to-clipboard button.⌉⌊ General configuration tab with secret slug generator and copy-to-clipboard button .⌉[ General configuration tab with secret slug generator and copy-to-clipboard button. [⌊Content and dual-language (Arabic/English) blocked page editor.⌉⌊Content and dual- language (Arabic/English) blocked page editor.⌉[ Content and dual-language (Arabic/English) blocked page editor. [⌊Appearance customizer with interactive real-time live preview.⌉⌊Appearance customizer with interactive real-time live preview.⌉[ Appearance customizer with interactive real-time live preview. [⌊Branded 403 Access Denied page displayed to unauthorized visitors.⌉⌊Branded 403 Access Denied page displayed to unauthorized visitors.⌉[ Branded 403 Access Denied page displayed to unauthorized visitors. ## Installation 1. Upload the `khalaf-login-access-guard` folder to your `/wp-content/plugins/` directory. 2. Activate the plugin via **Plugins Installed Plugins**. 3. Navigate to **Login Access Guard** in the WordPress admin menu. 4. Set your desired custom slug or click **Generate** for a secure random slug. 5. (Optional) Customize your Access Denied page and preview it in real time under the **Style & Live Preview** tab. 6. Toggle **Enable Protection** and save your settings. ## FAQ ### I forgot my custom login URL. How do I regain access? You can regain access at any time via FTP or your hosting File Manager: temporarily rename the `khalaf-login-access-guard` directory inside `/wp-content/plugins/` or delete the `klguard_settings` entry in `wp_options`. WordPress will immediately revert to the default `/wp-login.php`. ### Does this plugin work with WooCommerce and membership plugins? Yes. The plugin only intercepts direct visits to `/wp-login.php` and protects the admin area against unauthenticated access. It does not alter frontend account pages or WooCommerce endpoints. ### Will this break password reset emails or logout? No. Legitimate password reset links containing verification tokens, logout requests, and GDPR privacy actions are whitelisted and execute normally. ### Does it work with caching plugins? Yes. Ensure your caching plugin (WP Rocket, LiteSpeed, W3 Total Cache, etc.) is configured to exclude your custom secret login slug from page caching. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “KHALAF Login Access Guard” is open source software. The following people have contributed to this plugin. Contributors * [ Ahmed Khalaf ](https://profiles.wordpress.org/khalaf22/) [Translate “KHALAF Login Access Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/khalaf-login-access-guard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/khalaf-login-access-guard/), check out the [SVN repository](https://plugins.svn.wordpress.org/khalaf-login-access-guard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/khalaf-login-access-guard/) by [RSS](https://plugins.trac.wordpress.org/log/khalaf-login-access-guard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release of KHALAF Login Access Guard. * Fully customizable 403 Access Denied page with real-time live preview. * Native dual-language (Arabic & English) with RTL support. * Cryptographic slug generator using window.crypto. * XML-RPC brute force protection toggle. * Full WordPress.org plugin directory compliance. ## Meta * Version **1.0.0** * Last updated **23 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.0 or higher ** * Tested up to **6.7.9** * PHP version ** 7.4 or higher ** * Tags * [Brute Force](https://wordpress.org/plugins/tags/brute-force/)[custom login url](https://wordpress.org/plugins/tags/custom-login-url/) [hide login](https://wordpress.org/plugins/tags/hide-login/)[login](https://wordpress.org/plugins/tags/login/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/khalaf-login-access-guard/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/khalaf-login-access-guard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/khalaf-login-access-guard/reviews/) ## Contributors * [ Ahmed Khalaf ](https://profiles.wordpress.org/khalaf22/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/khalaf-login-access-guard/)