Title: Solutiontech Seguridad de acceso Author: solutiontechcl Published: September 3, 2026 Last modified: September 4, 2026 --- Search plugins ![](https://ps.w.org/solutiontech-seguridad-de-acceso/assets/banner-772x250.png? rev=3679784) ![](https://ps.w.org/solutiontech-seguridad-de-acceso/assets/icon.svg?rev=3679784) # Solutiontech Seguridad de acceso By [solutiontechcl](https://profiles.wordpress.org/solutiontechcl/) [Download](https://downloads.wordpress.org/plugin/solutiontech-seguridad-de-acceso.1.50.0.zip) * [Details](https://wordpress.org/plugins/solutiontech-seguridad-de-acceso/#description) * [Reviews](https://wordpress.org/plugins/solutiontech-seguridad-de-acceso/#reviews) * [Installation](https://wordpress.org/plugins/solutiontech-seguridad-de-acceso/#installation) * [Development](https://wordpress.org/plugins/solutiontech-seguridad-de-acceso/#developers) [Support](https://wordpress.org/support/plugin/solutiontech-seguridad-de-acceso/) ## Description Seguridad de acceso por Solutiontech protects WordPress access and reduces unnecessary public exposure without renaming core files or modifying .htaccess. Main features: * Agency Threat Network & Central Hub Mode: Connect to Solutiontech distributed threat intelligence network or operate as a central agency hub to synchronize IP blacklists and whitelists across client websites. * 2FA Emergency Backup Recovery Codes: Generates secure single-use recovery code sets in user profiles to prevent lockouts. * Cloudflare Turnstile Anti-Bot Protection: Frictionless, privacy-first bot detection challenge across login, registration, and lost password forms. * Malware Upload Shield (PHP File Scanner): Automatically scans /wp-content/uploads/ for suspicious executable PHP scripts and backdoors. * Interactive Audit Log Filter & Live Search: Instant client-side search and category filtering across recorded security events. * Authenticator App 2FA (TOTP – RFC 6238): Support for Google Authenticator, Microsoft Authenticator, and Authy with QR code pairing in user profiles. * GeoIP Country Restriction: Allow or block access based on visitor country code from reverse proxies and Cloudflare. * Security Email Alerts: Real-time HTML notifications with anti-flood rate limits for brute force, WAF blocks, and core discrepancies. * WordPress Dashboard Widget: Overview widget with security score ring, status pills, and 24-hour threat metrics. * Micro-WAF (Web Application Firewall): Early inspection and neutralisation of SQL Injections (SQLi), Cross-Site Scripting (XSS), Path Traversal (LFI), Remote Code Execution (RCE), and malicious security scanners. * IP Whitelist & Permanent Blacklist: Allows instant exclusion for trusted IPs and permanent 403 blocking for malicious IPs and CIDR ranges across the entire website. * WordPress Core File Integrity Checker: Verifies local core files against official WordPress.org cryptographic MD5 checksums to detect modified or missing CMS files. * Two-Factor Authentication (2FA via Email OTP): Delivers a 6-digit one-time code to authorized user emails to secure privileged logins. * Strong Password Policies & Expiration: Enforces 12+ character complexity and optional periodic password expiration reminders. * Official Internationalization & Translation Template: Standard .pot file included in languages/ for seamless translation with Poedit, Loco Translate, or WordPress. org GlotPress. * Invisible Honeypot Anti-Spam: Blocks automated bots across login, password recovery, registration, and comment forms without annoying CAPTCHAs. * Pingback & XML-RPC DDoS Protection: Strips X-Pingback headers and disables XML- RPC pingback reflection methods. * WordPress Core Hardening: Hide WordPress version from headers/feeds/asset query strings, remove legacy discovery tags (RSD, WLWManifest, oEmbed), and disable built-in file editing. * Background automated cleanup with WP-Cron for expired audit logs and 404 entries. * Secure CSV export for Audit Log and 404 Monitor with Excel UTF-8 BOM and formula injection protection. * Runtime in-memory caching for faster settings retrieval without redundant database queries. * Google reCAPTCHA v3 invisible bot protection with score threshold on login and lost-password forms. * HTTP Security Headers injection (X-Frame-Options, X-Content-Type-Options, Referrer- Policy, Permissions-Policy, and HSTS). * Progressive brute-force lockout with escalating lockout tiers for repeat offenders. * Optional WooCommerce catalog mode, including controls for administrators and variable products. * Security status dashboard with an informative score and links to each setting. * Responsive sidebar navigation organized by security area. * Session and device management based on native WordPress session tokens. * Individual session revocation, single-session policy, and optional inactivity timeout. * Optional alerts when a user signs in from a new device. * 404 monitor with retention, entry limits, and direct conversion to a redirect rule. * Same-site redirect manager supporting 301, 302, 307, and 308 responses. * Optional custom login URL and random URL regeneration. * Protection against direct access to wp-login.php and wp-admin for visitors. * Configurable login attempt limiting by IP address using WordPress transients. * Generic login errors to reduce account enumeration. * Optional author enumeration and public REST user endpoint protection. * Optional XML-RPC restriction. * Environment diagnostics for Multisite, subdirectories, proxy/CDN setups, WooCommerce, and recovery flows. * Optional deterrents for casual copying of images and text. * Local audit log for relevant authentication and administration events. * Configurable audit-log retention from 1 to 365 days, limited to 500 events. * Independent controls for new comments and pingbacks on posts and pages. * Optional email alerts when the login-attempt limit is reached. * Configurable response for blocked login routes: 404, home page, or a custom URL. The plugin does not modify WordPress files. After deactivation, WordPress uses its standard login routes again. Developer website: https://solutiontech.cl/ ### External Service and Privacy This plugin can optionally connect to the following external services: 1. Solutiontech Threat Intelligence Network (https://solutiontech.cl/) * Purpose: Synchronizes distributed IP blacklists and whitelists to protect WordPress installations against emerging cyber threats and brute-force campaigns. * Data sent: Site URL, WordPress core version, and plugin version upon manual or scheduled sync. If anonymous threat reporting is enabled, the IP address and reason for blocked attacks intercepted by the local Micro-WAF are sent. * Service provider: Solutiontech( https://solutiontech.cl) * Privacy Policy: https://solutiontech.cl/politica-de-privacidad/* Terms of Service: https://solutiontech.cl/terminos-y-condiciones/ * Note: This service is 100% OPT-IN and completely disabled by default until explicitly enabled by an administrator with a valid API key. 1. WordPress.org Core API (https://api.wordpress.org/) * Purpose: Verifies the integrity of WordPress core files by comparing local file hashes against official checksums. * Data sent: WordPress version and locale. * Service provider: WordPress Foundation * Privacy Policy: https://wordpress.org/about/ privacy/ 1. WPVulnerability API (https://www.wpvulnerability.net/) * Purpose: Scans installed plugins, themes, and WordPress core against public vulnerability databases (CVEs). * Data sent: Slugs and installed version numbers of plugins/themes( no personal or proprietary data). * Service provider: WPVulnerability * Privacy Policy: https://www.wpvulnerability.net/privacy/ ### External services This plugin can connect to the following third-party external services when explicitly configured and enabled by the site administrator: * **Google reCAPTCHA v3**: - _Purpose_: Protects authentication and password recovery forms against automated bots and credential-stuffing attacks. - _Data sent & when_: When enabled with site administrator API credentials, user interaction tokens and visitor IP address are sent to `https://www.google. com/recaptcha/api/siteverify` during form submission to obtain a risk confidence score. - _Service provider_: Google LLC. - _Terms of Service_: https://policies.google.com/terms - _Privacy Policy_: https://policies.google.com/privacy * **Cloudflare Turnstile**: - _Purpose_: Provides frictionless, privacy-preserving smart anti-bot challenge validation on login, registration, and lost password forms. - _Data sent & when_: When enabled with site administrator API credentials, the Turnstile response token and visitor IP address are sent to `https://challenges. cloudflare.com/turnstile/v0/siteverify` during form submission. - _Service provider_: Cloudflare, Inc. - _Terms of Service_: https://www.cloudflare.com/website-terms/ - _Privacy Policy_: https://www.cloudflare.com/privacypolicy/ * **WordPress.org Core Checksums API**: - _Purpose_: Validates the integrity of local WordPress CMS files against official cryptographic checksums in the Diagnostics panel. - _Data sent & when_: The current WordPress version and locale string (e.g., version and language code) are sent to `https://api.wordpress.org/core/checksums/ 1.0/` only when an administrator clicks the “Comprobar integridad del núcleo” button in the diagnostics dashboard. No user personal data is sent. - _Service provider_: WordPress Foundation / WordPress.org. - _Privacy Policy_: https://wordpress.org/about/privacy/ * **Note on 2FA QR Codes**: Two-Factor Authentication (TOTP) QR codes are generated 100% locally on your server in pure PHP as inline SVG. No secret keys or user data are ever sent to any external server or third-party service. ### Privacy The plugin does not send telemetry to Solutiontech. Optional security modules store their data locally in the WordPress database. Audit events may include complete IP addresses for forensic traceability, while the administration table displays masked addresses. WordPress session tokens may contain IP, browser, and date information. The 404 monitor does not store IP addresses or query parameters. If email alerts are enabled, the site sends the relevant information through its configured mail system. Site administrators are responsible for providing any required privacy notice and choosing an appropriate retention period. ## Screenshots [⌊Security Overview Dashboard with safety score gauge, protection indicators, and module matrix.⌉⌊Security Overview Dashboard with safety score gauge, protection indicators, and module matrix.⌉[ Security Overview Dashboard with safety score gauge, protection indicators, and module matrix. [⌊Custom Login URL and Brute-Force Rate Limiting configuration.⌉⌊Custom Login URL and Brute-Force Rate Limiting configuration.⌉[ Custom Login URL and Brute-Force Rate Limiting configuration. [⌊Micro-WAF (Web Application Firewall), IP Access Lists (Whitelist/Blacklist), and Country Geolocation Filtering (GeoIP).⌉⌊Micro-WAF (Web Application Firewall), IP Access Lists (Whitelist/Blacklist), and Country Geolocation Filtering (GeoIP).⌉[ Micro-WAF (Web Application Firewall), IP Access Lists (Whitelist/Blacklist), and Country Geolocation Filtering (GeoIP). [⌊Interactive Live Forensic Audit Log with instant search, category filtering, and CSV export.⌉⌊Interactive Live Forensic Audit Log with instant search, category filtering, and CSV export.⌉[ Interactive Live Forensic Audit Log with instant search, category filtering, and CSV export. ## Installation 1. Upload the `solutiontech-seguridad-de-acceso` folder to `/wp-content/plugins/`, or install the ZIP from Plugins > Add Plugin. 2. Activate the plugin. 3. Open Seguridad de acceso from the main WordPress administration menu. 4. Save or copy the new login URL before signing out. 5. Enable only the modules required by the site. ## FAQ ### What happens if I forget the custom login URL? Temporarily rename the plugin folder using your hosting control panel, FTP, or SSH. WordPress will use wp-login.php again while the plugin is disabled. ### Does the plugin modify .htaccess or WordPress core files? No. ### What does the audit log record? When enabled, it stores the date and time, related user, available IP address, event type, and a short description of selected security and administration events. The data remains in the site’s own database. ### Is the audit log enabled by default? No. It is optional and disabled by default. ### What happens when comments are blocked? New comments and pingbacks are prevented for the selected content type. Existing comments are not deleted. ### Can content protection completely prevent copying? No. These controls are deterrents. Content downloaded by a browser may still be obtained by other means or captured in a screenshot. ### Is the plugin compatible with Multisite, subdirectory installations, and WooCommerce? The plugin includes diagnostics and dedicated handling for these environments. On Multisite, settings are stored per site. After changing the login URL, test sign- in, sign-out, and password recovery in a private browser window. ### Which redirect types are supported? The redirect manager supports 301, 302, 307, and 308. The source and destination must belong to the current site’s domain. External hosts, duplicates, loops, and critical WordPress routes are rejected. ### How does session management work? The Sessions section uses native WordPress session tokens. Administrators can review devices, close an individual session, close other sessions for their own account, or revoke sessions for another accessible account. The current administrative session is protected against accidental revocation. ### What information does the 404 monitor store? It stores the requested path without query parameters, a referrer without query parameters, a general browser/device description, first and last detection times, and a hit count. It does not store IP addresses and excludes administration, REST, AJAX, cron, critical routes, and request methods other than GET or HEAD. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Solutiontech Seguridad de acceso” is open source software. The following people have contributed to this plugin. Contributors * [ solutiontechcl ](https://profiles.wordpress.org/solutiontechcl/) [Translate “Solutiontech Seguridad de acceso” into your language.](https://translate.wordpress.org/projects/wp-plugins/solutiontech-seguridad-de-acceso) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/solutiontech-seguridad-de-acceso/), check out the [SVN repository](https://plugins.svn.wordpress.org/solutiontech-seguridad-de-acceso/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/solutiontech-seguridad-de-acceso/) by [RSS](https://plugins.trac.wordpress.org/log/solutiontech-seguridad-de-acceso/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.50.0 * Modo Agencia y Red Global de Inteligencia de Amenazas (Threat Network): Conexión distribuida opcional para sincronizar listas negras y blancas de IPs en tiempo real con el servidor central de Solutiontech. * Soporte de Rol Dual (Modo Nodo Cliente vs Modo Servidor Central Hub): Permite operar como sitio cliente receptor de directivas de seguridad o como servidor central Hub para agencias de desarrollo y mantenimiento web. * Generador Criptográfico de Claves API de Clientes: Consola de administración en modo Hub para emitir, copiar con 1 clic, revocar y eliminar credenciales API seguras (`st_net_...`) para sitios clientes conectados. * Jerarquía Estricta Anti-Autobloqueo: La lista blanca local del cliente mantiene prioridad absoluta (#1) sobre cualquier regla de red global para evitar autobloqueos accidentales, con banner de advertencia prominente en la interfaz. * Endpoint REST API Seguro de Threat Feed y Telemetría: Endpoints autenticados vía `X-ST-Agency-Key` para entrega instantánea de feeds de ciberdefensa y stream de telemetría de ataques en vivo. * Cumplimiento Total de Directrices WordPress.org: Módulo 100% opt-in desactivado por defecto y sección formal de declaración de servicios externos en readme.txt. #### 1.40.0 * Escáner de Vulnerabilidades Conocidas (CVE): Audita el núcleo de WordPress, plugins y temas instalados contra la base de datos pública global de CVEs (WPVulnerability Intelligence) con soporte para evaluación de versiones afectadas, CVSS y enlaces oficiales. * Nuevo Panel y Menú Lateral “Escáner CVE”: Sección dedicada en la barra de navegación del plugin con métricas de severidad (Crítica, Alta, Media, Baja), botón de escaneo inmediato y tabla detallada con parches recomendados. * Alertas Proactivas en WP-Cron: Escaneo diario en segundo plano con despacho automático de notificaciones por Correo y Webhooks (Discord, Slack, Telegram, JSON) al detectar vulnerabilidades críticas. * Chequeo Oficial en Salud del Sitio: Integración del 6º control de seguridad certificado en Herramientas > Salud del sitio de WordPress. #### 1.30.0 * Perfiles de Configuración Rápida en 1 Clic (Presets): Permite aplicar perfiles preconfigurados (Básico, Recomendado, Tienda / WooCommerce y Blindaje Total) directamente desde el panel de Resumen sin sobreescribir claves API ni datos sensibles. * Webhooks de Notificación Instantánea: Despacho asíncrono y en tiempo real de alertas de seguridad a canales de Discord (Embeds enriquecidos), Slack (Blocks interactivos), Telegram (Telegram Bot API con Chat ID) y Webhooks Genéricos ( JSON REST) con botón de prueba en 1 clic. * Integración Oficial con Salud del Sitio (WP_Site_Health API): 5 chequeos certificados en la herramienta nativa Herramientas > Salud del sitio de WordPress (Micro-WAF, 2FA, Integridad del Core, Blindaje de Uploads y Protección de wp-login.php). #### 1.24.0 * Threat Defense Center & Forensic Reports: Dedicated intelligence and monitoring panel with live threat KPI cards, visual attack vector distribution, Top 5 recurring hostile IPs with 1-click blacklist action, and custom Date Range Forensic CSV Report Generator (filter by date from/to, attack category, and severity). * Automatic IP Blacklist on Critical Attacks: Automatically adds offending IPs to permanent blacklist upon intercepting SQL Injection, Path Traversal / LFI / RCE, or hostile scanning tools. * WordPress Auto-Updates Manager: Centralized toggles in site protection to force automatic updates for WordPress core security releases, all installed plugins, and active themes. #### 1.23.2 * Internationalization: Adds complete native translation packages for 12 locales: Spanish (Chile, Mexico, Argentina, Colombia, Peru, Spain), English (US), Brazilian Portuguese, European Portuguese, French, Italian, Russian, and Simplified Chinese. #### 1.23.1 * Usability: Protected login URL is now disabled by default on initial activation to prevent unintended lockouts, allowing administrators to explicitly activate and customize their desired login route. #### 1.23.0 * Adds 2FA Emergency Backup Recovery Codes (8 single-use codes) in user profiles with cryptographic hashing. * Adds Cloudflare Turnstile anti-bot integration with support for login, registration, and lost-password forms. * Adds Malware Upload Shield (suspicious executable PHP file scanner in /wp-content/ uploads/) in diagnostics panel. * Adds interactive real-time search and category filtering in the Audit Log panel. #### 1.22.0 * Adds Two-Factor Authentication via Authenticator Apps (TOTP – RFC 6238) with Google/Microsoft Authenticator and QR code pairing in user profiles. * Adds real-time Security Email Alerts with HTML formatting and anti-flood throttling for Brute Force lockouts, WAF attacks, and Core Integrity modifications. * Adds Country Geolocation Filtering (GeoIP) with Allowlist/Blocklist modes and Reverse Proxy / Cloudflare header detection. * Adds WordPress Dashboard Security Widget with score gauge, protection indicators, and 24h threat summary. * Fully compliant with WordPress.org Plugin Check validation and standards. #### 1.21.0 * Adds Micro-WAF (Web Application Firewall) to detect and block SQL Injection, XSS, Path Traversal / LFI / RCE, and malicious scanner tools with forensic audit logging. * Adds IP Whitelist and Permanent Blacklist management with support for IPv4, IPv6, and CIDR subnet notations. * Adds WordPress Core File Integrity Checker comparing local core files against official WordPress.org cryptographic checksums with diagnostics dashboard integration. * Integrates WAF, IP rules, and Core Integrity status into the security dashboard health score. #### 1.20.0 * Adds Two-Factor Authentication (2FA via Email OTP) with 6-digit cryptographic verification code and brute-force attempt limits. * Adds Strong Password Policies enforcing 12+ characters, uppercase, lowercase, numbers, and symbols during user creation and password resets. * Adds optional periodic password expiration reminders for privileged user accounts. * Integrates 2FA and password policy health checks into the security dashboard status score. #### 1.19.0 * Adds official translation infrastructure with standard GNU gettext POT template(` languages/solutiontech-seguridad-de-acceso.pot`). * Declares `Domain Path: /languages` in plugin headers for automatic native localization via WordPress Core. * Fully compatible with Poedit, Loco Translate, WP-CLI, and WordPress.org GlotPress translation platform. #### 1.18.0 * Adds Invisible Honeypot Anti-Spam protection across login, lost password, user registration, and comment forms to eliminate automated spam bot submissions. * Adds Pingback protection: removes X-Pingback headers from server responses and disables XML-RPC pingback methods to mitigate DDoS amplification vectors. * Adds optional Time-Gate submission speed filter to discard instant automated bot form submissions. * Integrates anti-spam and honeypot indicators into the security dashboard score and administration panel. #### 1.17.0 * Adds WordPress Core Hardening module: hides generator meta tags, RSS/Atom version info, and removes ?ver= query strings matching the WordPress core version from public assets. * Removes legacy and unnecessary discovery tags from HTML head (RSD link, WLWManifest link, and oEmbed discovery links). * Adds theme and plugin file editor disabling (`DISALLOW_FILE_EDIT` enforcement and capability filtering) to prevent arbitrary PHP execution in case of account compromises. * Integrates Core Hardening items into the security dashboard health score and environment diagnostics panel. #### 1.16.0 * Adds daily scheduled WP-Cron task (`solutiontech_seguridad_acceso_daily_cleanup`) for automated asynchronous pruning of audit logs and 404 monitor entries. * Adds secure CSV export functionality for Audit Log and 404 Monitor with UTF-8 BOM encoding for Excel compatibility and CSV formula injection protection. * Implements runtime in-memory caching for settings retrieval to optimize database performance. #### 1.15.0 * Adds Google reCAPTCHA v3 invisible protection for login and lost-password forms with customizable confidence score threshold. * Adds HTTP Security Headers module (X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and HSTS). * Adds Progressive Brute-Force Lockout feature with escalating penalty tiers for recurring attack IPs (1x base duration -> 4x -> 24 hours). * Integrates new protection modules into the security status score and diagnostics dashboard. #### 1.14.4 * Resolves Plugin Check update_modification_detected warning by removing core and plugin auto-update management to comply fully with WordPress.org guidelines. #### 1.14.3 * Clearly distinguishes deleting a 404 history row from permanently resolving the missing URL. * Renames the redirect action to Resolve permanently and uses a permanent 301 redirect by default. * Removes the monitored 404 entry after its redirect is saved successfully. #### 1.14.2 * Resolves the findings from Plugin Check concerning readme metadata, input handling, nonce analysis, and prefixed uninstall variables. * Uses WordPress’ native automatic-update preferences instead of filtering the plugin updater at runtime. * Adds regression checks for packaging and WordPress.org compatibility metadata. #### 1.14.1 * Fixes an interpolated translation string in the temporary lockout email. * Adds regression coverage for static translatable strings and placeholder substitution. #### 1.14.0 * Adds WooCommerce catalog mode under Content. * Hides purchasing, cart, checkout, and optional variation controls. * Can apply catalog mode to administrators while preserving existing order links. #### 1.13.5 * Resolves internationalization findings reported by Plugin Check. * Adds translator comments and ordered placeholders. #### 1.13.4 * Prevents inactivity enforcement from intercepting REST requests used by the block editor. * Masks IP addresses in the audit-log table. #### 1.13.3 * Restricts redirect sources and destinations to the current domain. #### 1.13.2 * Improves redirect normalization for omitted schemes and subdirectory installations. #### 1.13.1 * Uses the full available width on desktop displays. #### 1.13.0 * Adds individual session management for other accessible users. #### 1.12.5 * Strengthens route, redirect, import, IPv6, and Multisite handling. #### 1.12.4 * Improves diagnostic-card layout and responsive presentation. #### 1.12.3 * Removes the promotional header from the administration panel. #### 1.12.2 * Makes dashboard controls link directly to their related settings. #### 1.12.1 * Improves the Copy URL button and renames technical hardening labels. #### 1.12.0 * Adds the 404 monitor and refreshes the administration design. #### 1.11.0 * Adds sessions, device alerts, single-session policy, and inactivity timeout. #### 1.10.0 * Adds the same-site redirect manager. #### 1.9.0 * Adds responsive sidebar navigation. #### 1.8.0 * Adds emergency recovery, JSON import/export, reset tools, and an IP allowlist. ## Meta * Version **1.50.0** * Last updated **7 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [audit log](https://wordpress.org/plugins/tags/audit-log/)[Brute Force](https://wordpress.org/plugins/tags/brute-force/) [content-protection](https://wordpress.org/plugins/tags/content-protection/)[login](https://wordpress.org/plugins/tags/login/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/solutiontech-seguridad-de-acceso/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/solutiontech-seguridad-de-acceso/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/solutiontech-seguridad-de-acceso/reviews/) ## Contributors * [ solutiontechcl ](https://profiles.wordpress.org/solutiontechcl/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/solutiontech-seguridad-de-acceso/)