{"id":369477,"date":"2026-10-12T14:03:13","date_gmt":"2026-10-12T14:03:13","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/blog-cutter-smart-security-management\/"},"modified":"2026-10-12T13:48:03","modified_gmt":"2026-10-12T13:48:03","slug":"blog-cutter-smart-security-management","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/blog-cutter-smart-security-management\/","author":23447953,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"2.1.4","stable_tag":"trunk","tested":"7.1.3","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Blog Cutter Smart Security Management","header_author":"Imran Dev BD","header_description":"Helps protect WordPress with a visitor challenge, login and comment shields, optional two-factor authentication, a local firewall, hardening options, and security logs. Does not phone home.","assets_banners_color":"344259","last_updated":"2026-10-12 13:48:03","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/blogcutter.com\/blog-cutter-smart-security-management","header_author_uri":"https:\/\/blogcutter.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":59,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":[],"upgrade_notice":{"2.1.4":"<p>Prevents WordPress 6.7+ early translation notices by moving cron scheduling to init and guarding cron schedules.<\/p>","2.1.3":"<p>Fixes activation fatal error and safely preserves and appends uploads\/.htaccess configuration using WordPress core markers.<\/p>","2.1.2":"<p>Removes legacy helper file, removes file mod restrictions to maintain core update support, and eliminates automatic uploads filesystem writes.<\/p>","2.1.1":"<p>Uses WordPress core capability and file_mod_allowed filters for file editing and modification restrictions, and strengthens input sanitization.<\/p>","2.1.0":"<p>Uses a longer unique prefix for functions, options, and hooks. Existing settings are migrated automatically.<\/p>","2.0.0":"<p>Adds two-factor authentication, a local health check, and privacy tools. Review Settings after update. Magic login links now require a confirm click.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3741791,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3741791,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3741791,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3741791,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":[],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3741791,"resolution":"1","location":"assets","locale":"","width":1178,"height":866},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3741791,"resolution":"2","location":"assets","locale":"","width":1185,"height":3739},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3741791,"resolution":"3","location":"assets","locale":"","width":1182,"height":550},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3741791,"resolution":"4","location":"assets","locale":"","width":1172,"height":582},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3741791,"resolution":"5","location":"assets","locale":"","width":1186,"height":900},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3741791,"resolution":"6","location":"assets","locale":"","width":1178,"height":461}},"screenshots":{"1":"The dashboard shows protection status and events from the last 24 hours.","2":"Settings for the visitor gate, rate limiting, login shield, comments, crawlers, firewall, hardening, and two-factor authentication.","3":"Security logs stay in your database. Filter them and export a CSV.","4":"Magic login stays locked until an email delivery test succeeds.","5":"The health screen runs local checks and does not contact a remote service.","6":"Administrators can review and revoke active sessions."}},"plugin_section":[],"plugin_tags":[9211,362,1174,602,600],"plugin_category":[38,44,54],"plugin_contributors":[257396],"plugin_business_model":[],"class_list":["post-369477","plugin","type-plugin","status-publish","hentry","plugin_tags-2fa","plugin_tags-captcha","plugin_tags-firewall","plugin_tags-login","plugin_tags-security","plugin_category-authentication","plugin_category-discussion-and-community","plugin_category-security-and-spam-protection","plugin_contributors-blgctterai","plugin_committers-blgctterai"],"banners":{"banner":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/banner-772x250.png?rev=3741791","banner_2x":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/banner-1544x500.png?rev=3741791","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/icon-128x128.png?rev=3741791","icon_2x":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/icon-256x256.png?rev=3741791","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/screenshot-1.png?rev=3741791","caption":"The dashboard shows protection status and events from the last 24 hours."},{"src":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/screenshot-2.png?rev=3741791","caption":"Settings for the visitor gate, rate limiting, login shield, comments, crawlers, firewall, hardening, and two-factor authentication."},{"src":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/screenshot-3.png?rev=3741791","caption":"Security logs stay in your database. Filter them and export a CSV."},{"src":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/screenshot-4.png?rev=3741791","caption":"Magic login stays locked until an email delivery test succeeds."},{"src":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/screenshot-5.png?rev=3741791","caption":"The health screen runs local checks and does not contact a remote service."},{"src":"https:\/\/ps.w.org\/blog-cutter-smart-security-management\/assets\/screenshot-6.png?rev=3741791","caption":"Administrators can review and revoke active sessions."}],"raw_content":"<!--section=description-->\n<p>Blog Cutter Smart Security Management is a local WordPress security helper. It stays on your site: it does not phone home, load remote scripts, or use a third-party threat feed.<\/p>\n\n<p>The plugin can:<\/p>\n\n<ul>\n<li>Show a simple math challenge to suspicious guests, rate-limited browsers, or 404 probes<\/li>\n<li>Rate-limit unique URLs per IP and log the event<\/li>\n<li>Add a math check and lockout to the login form<\/li>\n<li>Hide wp-login.php behind a secret slug (optional)<\/li>\n<li>Protect comments and user registration with a math check and honeypot<\/li>\n<li>Offer optional TOTP two-factor authentication from the user profile (authenticator app, no SaaS)<\/li>\n<li>Apply common hardening: hide the generator tag, disable XML-RPC, block user enumeration, send security headers<\/li>\n<li>Block common exploit probes in the request URI (local pattern list)<\/li>\n<li>Store security events (IP, user agent, URL) in your database for a limited time<\/li>\n<li>Run a local health checklist and let administrators revoke sessions<\/li>\n<\/ul>\n\n<p>This plugin helps reduce automated attacks. It cannot guarantee that a site will never be compromised. Keep WordPress, themes, and plugins updated, use strong unique passwords, and take regular backups.<\/p>\n\n<h4>How to configure<\/h4>\n\n<ol>\n<li>After activation, open <strong>Blog Cutter Security<\/strong> in the admin menu.<\/li>\n<li>Review <strong>Settings<\/strong>. Defaults are conservative for new installs (anonymous REST lockdown and HSTS are off).<\/li>\n<li>Optional: enable two-factor authentication on each administrator <strong>Profile<\/strong>.<\/li>\n<li>Optional: <strong>Magic Login<\/strong> \u2014 send a test email first, then enable the one-time link. Opening the link requires a confirm click so email scanners cannot sign anyone in.<\/li>\n<li>If you hide the login URL, bookmark the secret slug. Locked out? Add <code>define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true );<\/code> to wp-config.php, or deactivate the plugin over FTP \/ file manager.<\/li>\n<\/ol>\n\n<h4>Privacy<\/h4>\n\n<p>When logging is enabled, the plugin stores IP addresses, user agents, requested URLs, and short event details in a table on this site. Data is not sent to the plugin author. Suggested privacy-policy text is added under Tools \u2192 Privacy. Personal data export and erase callbacks are registered. Email is used only when an administrator enables magic login, login alerts, or the weekly digest.<\/p>\n\n<h4>Third-party services<\/h4>\n\n<p>None. Reverse-DNS crawler verification (optional) uses the server\u2019s DNS resolver only.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>blog-cutter-smart-security-management<\/code> folder to <code>\/wp-content\/plugins\/<\/code><\/li>\n<li>Activate <strong>Blog Cutter Smart Security Management<\/strong><\/li>\n<li>Open <strong>Blog Cutter Security<\/strong> and review Settings, Health, and Logs<\/li>\n<li>Enable two-factor authentication from your Profile if you want it<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20search%20engines%20still%20index%20the%20site%3F\"><h3>Will search engines still index the site?<\/h3><\/dt>\n<dd><p>Trusted crawler user agents can skip the visitor gate. Optional reverse-DNS verification is available for stricter checks.<\/p><\/dd>\n<dt id=\"can%20i%20require%20a%20challenge%20for%20every%20guest%3F\"><h3>Can I require a challenge for every guest?<\/h3><\/dt>\n<dd><p>Yes. Set Gate mode to \u201cAlways challenge guests\u201d.<\/p><\/dd>\n<dt id=\"why%20is%20rest%20lockdown%20off%20by%20default%3F\"><h3>Why is REST lockdown off by default?<\/h3><\/dt>\n<dd><p>Locking the REST API for anonymous users can break forms, blocks, and shopfronts. Enable it only if you have tested those features.<\/p><\/dd>\n<dt id=\"does%20this%20plugin%20update%20itself%20from%20another%20server%3F\"><h3>Does this plugin update itself from another server?<\/h3><\/dt>\n<dd><p>No. Updates should come from WordPress.org after the plugin is hosted there, or from the zip you install.<\/p><\/dd>\n<dt id=\"i%20hid%20the%20login%20url%20and%20cannot%20sign%20in\"><h3>I hid the login URL and cannot sign in<\/h3><\/dt>\n<dd><p>Add <code>define( 'BLOGCUSM_DISABLE_HIDE_LOGIN', true );<\/code> to wp-config.php, or deactivate the plugin over FTP \/ file manager.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>2.1.4<\/h4>\n\n<ul>\n<li>Prevent early translation loading notice in WordPress 6.7+ by moving cron scheduling to the init hook<\/li>\n<li>Guarded cron_schedules display text to avoid calling translation functions before the init hook<\/li>\n<li>Guarded early firewall block messages against early translation calls<\/li>\n<\/ul>\n\n<h4>2.1.3<\/h4>\n\n<ul>\n<li>Resolved activation fatal error by ensuring BLOGCUSM_Uploads::ensure_uploads_rules() is defined<\/li>\n<li>Safely preserves and appends existing rules in uploads\/.htaccess using WordPress core markers (insert_with_markers)<\/li>\n<li>Cleans up plugin rules and markers upon deactivation and uninstall<\/li>\n<\/ul>\n\n<h4>2.1.2<\/h4>\n\n<ul>\n<li>Removed standalone emergency unlock helper file in compliance with directory guidelines<\/li>\n<li>Removed disallow_file_mods setting to ensure uninterrupted WordPress core and plugin updates<\/li>\n<li>Replaced runtime secret login define with static request state<\/li>\n<li>Added file extension validation for settings JSON import<\/li>\n<li>Added HTML escaping for challenge fields<\/li>\n<\/ul>\n\n<h4>2.1.1<\/h4>\n\n<ul>\n<li>Replaced runtime constant defines (DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS) with WordPress core map_meta_cap and file_mod_allowed filters<\/li>\n<li>Comprehensive input sanitization and validation across $_SERVER, $_POST, and $_FILES arrays<\/li>\n<li>Safe settings import using WordPress core wp_json_file_decode<\/li>\n<\/ul>\n\n<h4>2.1.0<\/h4>\n\n<ul>\n<li>Unique 8-character plugin prefix, nonce checks on form handlers, and admin notices limited to plugin\/profile screens<\/li>\n<\/ul>\n\n<h4>2.0.0<\/h4>\n\n<ul>\n<li>Aligned headers, readme, and copy with WordPress.org plugin guidelines<\/li>\n<li>Added local TOTP two-factor authentication, health checks, session revocation, and GDPR export\/erase<\/li>\n<li>Added registration and password-reset protection, optional login alerts, and settings export\/import<\/li>\n<li>Safer defaults for anonymous REST lockdown, application passwords, and HSTS<\/li>\n<li>Magic login now requires a confirm click; emergency unlock no longer disables other plugins<\/li>\n<li>Challenge tokens no longer use Base64; styles are printed through WordPress APIs<\/li>\n<\/ul>\n\n<h4>1.1.1<\/h4>\n\n<ul>\n<li>Hidden login, WAF, and hardening updates<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<\/ul>","raw_excerpt":"Helps reduce automated abuse with a visitor challenge, login shields, optional two-factor authentication, local hardening, and logs.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/369477","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=369477"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/blgctterai"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=369477"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=369477"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=369477"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=369477"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=369477"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=369477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}