Zen Login & Authentication

Changelog

2.2.3

• Compatibility: the rate limiter’s companion “timestamp” transient key is now built as an explicitly prefixed name (zenlogau_rl_ts_…) instead of appending a suffix to the counter key, so it passes strict option/transient naming checks. No behaviour, settings, or data changes.
• Hardening: added a direct-access (ABSPATH) guard to the bundled WebAuthn library’s remaining PHP files, so none can be executed if requested directly.

2.2.1

• Security: passkey sign-in now requires user verification (a PIN, fingerprint, or face) by default. A passkey login bypasses both the password and two-factor step, so it must be a real second factor — this closes a gap where a presence-only authenticator could complete a sign-in. Filterable for sites that must support PIN-less security keys.
• Hardening: the plugin’s login, registration, password, and account pages now send X-Frame-Options and X-Content-Type-Options headers (anti-clickjacking + MIME-sniffing protection), matching wp-login.php. The frame policy is filterable.

2.2.0

• New: “Trust this device for 30 days” option on the two-factor login screen — a trusted browser skips the code prompt on future logins (the password is always still required). Trusted devices are cleared whenever two-factor is turned off. Toggle it under Settings (on by default); the trusted length is filterable.
• New: per-account login throttle (Settings, on by default). Alongside the existing per-IP limiter, repeated failed logins for the same username now add a short, progressively longer delay. It is a delay, not a lockout, so it can never be used to lock a real user out, and it slows password-guessing that rotates IP addresses.
• Improved: accounts created with Google sign-in are no longer asked for a “current password” they never set when editing their profile — the requirement adapts automatically and re-applies once they set a password.
• Improved: encrypted secrets now survive a wp-config.php salt rotation. Each value is tagged with its key, and the previous salt material can be supplied via a filter so secrets are decrypted and re-encrypted under the new key instead of being lost.
• Improved: faster Google-account lookups on large sites (indexed reverse lookup instead of a full user-meta scan).
• Security: bundled WebAuthn library — tightened the passkey origin check (an exact domain or true subdomain match, not a loose suffix) and removed an unused metadata-service routine that wrote files to an arbitrary folder.
• Developer: simpler version-gated upgrade routine (a version → callback map).

2.1.6

• Session Management: “Log Out” and “Sign out of all other devices” are now text action links again (matching the other account links) instead of buttons.
• Elementor: added an “Action Links” style section to the Account widget so the text links — Log Out, Sign out of all other devices, Turn off two-factor authentication, Cancel, and Remove (passkey) — can be styled (colour, hover colour, typography, and alignment) from the toolbar.
• Fixed the production stylesheet missing the Session Management device-list styles.

2.1.5

• Account restructure follow-ups: card headings use the plugin’s own colour and have their own Elementor style controls (they no longer inherit the theme heading colour); removed a stray Log Out link; the Session Management card now lists the devices currently signed in; success notices clear after a refresh; and the Elementor editor preview matches the live card layout.

2.1.4

• Restructured the Account page into clear cards — Profile Information, Change Password, Passkeys, Two-Factor Authentication, and Session Management — with two-column profile fields and separate “Save Profile” and “Update Password” actions. Same colours, clearer layout.

2.1.3

• Security hardening (post-audit): turning OFF two-factor authentication now requires a current authenticator or recovery code, and TOTP codes can no longer be replayed within their validity window.
• Auto-login after registration now fires the standard login hook, so new-device alerts and the activity log capture it.
• Passkey sign-in is now rate-limited and validates the authenticator signature counter (clone detection for hardware security keys).
• Changing your email address or password on the Account page now requires your current password (filterable for sites whose users sign in only with Google or passkeys).
• Added GDPR personal-data export and erasure support (Tools → Export/Erase Personal Data) covering devices, passkeys, two-factor, and Google links.
• Bundled WebAuthn library: added direct-access protection and switched to WordPress HTTP/filesystem/URL helpers.
• Administrators can reset a locked-out user’s two-factor authentication and passkeys from the user-edit screen.
• Login-activity pruning now also runs on a daily schedule (a reliable backstop on low-traffic sites).
• Uninstall now also clears the plugin’s transients.

2.1.2

• Security/hardening: every Elementor editor-preview template now escapes interpolated field values (titles, labels, button/link text, passkey and Google button text). The editor preview previously used raw interpolation, which could render unescaped HTML inside the builder.
• The Google sign-in button preview is now built entirely from escaped, literal markup — removing a misleading “escaped during construction” suppression flagged in review.
• Added late output escaping / input unslashing throughout per the WordPress Plugin Directory review (Cloudflare request-method check, new-device cookie), and documented the unavoidable core-hook and cache-plugin signal names.
• No functional changes — forms, passkeys, two-factor, and new-device alerts behave exactly as in 2.1.1.

2.1.1

• Redesigned login, registration, and account forms: a polished default card surface, a refined “security blue” palette, full-width primary buttons, and an outline secondary style — all still controllable from the Elementor toolbar.
• The “Sign in with a passkey” button now has an icon and its own Normal/Hover style controls, and sits below the “or” divider with the other sign-in options.
• Cleaner input focus (solid border + soft ring, no floating outline) and no stray hover border on buttons.
• The new-device alert email is now a styled, mobile-friendly HTML message, with an optional admin-supplied custom body.
• Added the missing password placeholder controls on the Account widget; the Elementor editor now previews the passkey, Google, two-factor, and passkeys/sessions sections.

2.1.0

• New: Passkeys (WebAuthn). Users can add passkeys from the Account page and sign in with no password using Face ID, a fingerprint, Windows Hello, or a security key. Passwordless sign-ins are phishing-resistant and count as multi-factor, so they skip the password and any two-factor step. Credentials are verified locally by the bundled lbuchs/WebAuthn library (MIT) using “none” attestation — no external request is made. Requires HTTPS.
• New: New-device login alerts. Emails the account owner the first time their account is signed in from an unrecognised device or browser (similar to the “new sign-in” alerts from Google or GitHub). Recognises devices with a long-lived cookie and sends with your site’s normal email — no external service. On by default.

2.0.0

• New: Two-factor authentication (TOTP). Opt-in per user, managed entirely from the Account page: scan a QR code (or enter the setup key) in any authenticator app, confirm a code to turn it on, and save one-time recovery codes. After the password, a second-factor step is required — enforced across the plugin’s forms, AJAX submissions, and wp-login.php (REST/XML-RPC application passwords and Google sign-in are unaffected). The shared secret is stored encrypted at rest and recovery codes are stored hashed and single-use; the login challenge sets no auth cookie until the second factor verifies.
• The enrollment QR is rendered locally by the bundled qrcode-generator library (Kazuhiko Arase, MIT) — no external request is made.
• New: Sign out of other devices on the Account page — ends every active session except the current one, so users can recover from a shared or lost device.
• Hardening: the subscriber-redirect setting now keeps full URLs intact (sanitized with esc_url_raw() rather than sanitize_text_field(), which could mangle a valid URL).

1.9.0

• New: Security Hardening panel. Username-enumeration protection — blocks ?author=N author scans and the REST /wp/v2/users listing for logged-out visitors, and makes login errors generic so a valid username is never confirmed — is on by default. Optional XML-RPC lockdown closes the system.multicall brute-force amplifier and pingback abuse.
• New: Breached-password blocking (optional). Rejects passwords found in the Have I Been Pwned corpus at registration, password reset, and account update, using the k-anonymity range API — only the first 5 characters of the password’s SHA-1 hash leave the site, never the password — and failing open if the service is unreachable.
• New: Cloudflare Turnstile bot protection (optional) on the login, registration, and lost-password forms — both the plugin’s forms and wp-login.php — with server-side token verification. The secret key is stored encrypted at rest.

1.8.1

• Housekeeping: removed the one-time pre-release prefix-migration routine (it had served its purpose; all known installs are already on the current zenlogau prefix). No change to normal installs or updates.

1.8.0

• Internal: the plugin’s PHP/option prefix is now zenlogau (functions, classes, constants, options, transients, user/post meta, and the activity table). A one-time migration moves existing data automatically on update, so your settings, Google credentials, pages, and activity log carry over.

1.7.2

• Removed a read of WP Super Cache’s $file_prefix global during cache purge; auth pages already set DONOTCACHEPAGE, which WP Super Cache honours, so no explicit purge is needed.

1.7.1

• Renamed the plugin to Zen Login & Authentication for a distinctive directory name.
• All admin CSS is now enqueued (no inline <style> blocks).
• Asset handles use a distinct prefix.
• The Google client secret is encrypted from its raw value (no lossy pre-sanitization).

1.7.0

• New: Login activity dashboard widget. A “Login Activity” panel on the WordPress dashboard shows, for the past week, the number of successful logins, failed attempts, and lockouts, plus the top failed usernames, the most-blocked IPs, and a recent-events feed. Successful and failed logins are captured for every login path (the plugin’s forms, wp-login.php, and programmatic logins); lockouts come from the plugin’s rate limiter. IP addresses are stored anonymised (the same value the rate limiter buckets on). Settings → Zen Login & Authentication → Login Activity lets you turn logging off, set a retention window (default 30 days; old entries auto-prune), and clear the log. The activity table is removed on uninstall.

1.6.3

• Improved: post-login redirects now run WordPress’s standard login_redirect filter on every front-end login, so membership/LMS and other plugins are respected — wherever they send a user is honoured.
• Improved: restricted subscribers are never landed in wp-admin. A non-admin destination chosen by another plugin (a member area, a course page, an explicit redirect) is kept; only an empty or wp-admin target falls back to the Subscriber redirect. Administrators and editors are unaffected — their normal dashboard flow, including the “clicked Edit → login → back to Edit” round-trip, still works.

1.6.2

• New: per-widget switches under Settings → Zen Login & Authentication → Widgets — turn each form widget (Login, Registration, Lost Password, Reset Password, Account) on or off for both the Elementor panel and classic widget areas.
• Improved: the settings screen now uses 80% of the admin content area instead of a fixed narrow column.

1.6.1

• New: Account page & widget — frontend profile editing for logged-in users (read-only username, first and last name, a “Display name publicly as” dropdown that rebuilds live as you type — just like the wp-admin profile screen — plus email and an optional password change), available as an Elementor widget, a classic widget, and an auto-created /account/ page with the usual virtual-URL fallback. Email changes are validated (format + uniqueness); password changes follow the same rules as the reset form (match + 8-character minimum), keep the current session logged in, and sign out all other sessions. Guests visiting the account page are redirected to the login form and return after signing in. The page is excluded from page caches like every other auth page.
• Fixed: <select> fields no longer clip their text on themes that set a fixed height on selects (e.g. Astra); the dropdown now uses the plugin’s own styling with a consistent chevron.

1.5.0

• Security: the Google Client Secret is encrypted at rest (AES-256-GCM, keyed from your wp-config.php salts — a database dump alone cannot leak it) and is never re-displayed in the admin once saved. Both credentials can alternatively be defined as ZENLOGAU_GOOGLE_CLIENT_ID / ZENLOGAU_GOOGLE_CLIENT_SECRET constants in wp-config.php to keep them out of the database entirely. If you rotate your WordPress salts, re-enter the secret.
• Fixed: required-field asterisks were invisible — the honeypot’s catch-all CSS rule (.fauth [aria-hidden="true"]) also hid the decorative asterisk spans. The rule is now scoped to the honeypot element only.
• New: Sign in with Google (optional). A server-side OpenID Connect flow — no Google JavaScript on your pages and no third-party libraries. Configure a Client ID/Secret under Settings → Zen Login & Authentication → Sign in with Google; a “Continue with Google” button then appears on the login and registration forms (toggleable per Elementor widget, with its own style section). First-time Google users can be auto-created (toggleable); existing accounts are linked by verified email. Google logins respect the Subscriber redirect, wp-admin blocking, rate limiting, and the hidden-toolbar default for new sign-ups. CSRF protection via a single-use state token bound to the browser; only verified Google emails are accepted.

1.4.23

• Fixed: the Elementor editor preview now shows the in-field password toggle layout, matching the front end (the preview templates were missing the password-field modifier class).

1.4.22

• Design: refreshed the default form styling for a modern, polished look out of the box — softer rounded inputs and buttons, refined focus rings, fully-rounded status notices, an updated password strength meter, a brand-tinted “Remember Me” checkbox, and a cleaner password field (label above, with the Show/Hide toggle inside the field’s right edge so the input stays full-width like the other fields). Every value stays overridable via the --fauth-* CSS custom properties and the Elementor style controls. Applies to all four forms and every widget type (Elementor, classic, and virtual pages).
• Fixed (Elementor): the Form Container background, border, padding, radius, and shadow now wrap the form title too — previously the title rendered outside the styled container.

1.4.20

• New: subscribers who register through the plugin have the front-end admin toolbar (“Show Toolbar when viewing site”) hidden by default — a preference they can re-enable from their profile.
• New: subscribers are kept out of wp-admin and redirected to the Subscriber redirect destination (site home page by default). admin-ajax.php is exempt so front-end AJAX keeps working.
• Fixed: the Subscriber redirect now applies to every login path — the front-end form, wp-login.php, and third-party login flows — via a high-priority login_redirect filter. Previously it was only enforced inside the plugin’s own login form, so a security/membership plugin or a wp-login.php login could bypass it.
• Fixed: the “Settings” link on the Plugins screen now works regardless of the plugin’s folder name.
• Tested up to WordPress 7.0.

1.4.19

• Security: rate-limit IP detection now uses REMOTE_ADDR by default, closing a header-spoofing bypass. Cloudflare sites can opt the real-client header back in via the zenlogau_rate_limit_ip_headers filter.
• Fixed data loss on uninstall: only empty, unedited, plugin-created pages are removed; adopted and edited pages are always kept.
• Activation now adopts an existing page at each slug or creates one (idempotent, no duplicate pages).
• New: configurable Subscriber redirect setting (page slug or URL; empty = site home), replacing a hardcoded path.
• Housekeeping: dead-code removal and minor cleanups. No behaviour change.

1.4.18

• New: per-form rate limiting (enable/disable and threshold override per form) and a “count successful lost-password requests” option that closes the reset-email spam loophole.
• Admin checkboxes now save correctly when unchecked.

1.4.17

• One-time database cleanup: removes orphaned options and prunes excess revisions on auth pages.

1.4.16

• Automatic cache exclusion and stale-404 purging for LiteSpeed, Super Page Cache, WP Rocket, W3 Total Cache, and WP Super Cache.
• Rewrite rules now flush automatically on the first load after an update.
• OAuth / REST (e.g. MCP) login flows are exempted from URL rewriting.

Older versions: see the project’s CHANGELOG / README on the plugin homepage.