DEV Community

Jacker Architect
Jacker Architect

Posted on

I Built a 15KB WordPress Login Shield After Hackers Installed a Backdoor on My Site

#wordpress #webdev #security #opensource

It started with a nightmare every WordPress site owner dreads: hackers kept resetting my admin passwords.

I was stuck in an endless loop of resetting credentials just to access my own site. Then, it escalated. They didn't just change passwords; they started mass-creating fake admin accounts. Finally, they crossed the line by installing a malicious backdoor plugin to steal my data.

I was done. But I was also done with the "solutions" available on the market.

The Problem with Existing Security Plugins

When I looked for a way to hide my login page and stop these attacks, every single plugin I found had the same issues:

  1. Massive Bloat: They loaded heavy JavaScript, CSS, and external API calls on the frontend, destroying my Core Web Vitals.
  2. Fragile Architecture: They simply renamed wp-login.php to my-secret-login.php. Modern bots easily guess these renamed URLs.
  3. Broken Modern Auth: They completely broke WordPress 6.3+ Passkeys and standard 2FA plugins because they hijacked the login flow poorly.

I needed something surgical. I needed to block the attack vectors at the core, without touching the frontend performance.

Building "Hide Login Secure"

I analyzed the attack vectors myself and built a custom solution from scratch. The result is Hide Login Secure, an open-source plugin that weighs in at just 15.6 KB (unzipped: 63.2 KB).

Here is how it actually protects your site:

1. True URL Hiding with Signed Tokens

Instead of just renaming the login URL, the plugin generates a short-lived, HMAC-SHA256 signed access cookie.
Even if a bot guesses your custom login slug, it cannot access the wp-login.php form without a valid, cryptographically signed token. The token expires in 5 minutes.

2. Cloudflare-Aware IP Detection

Many lightweight plugins fail behind proxies. This plugin securely detects real visitor IPs behind Cloudflare (and other proxies) by validating the request against the official Cloudflare IP ranges (supporting IPv4, IPv6, and CIDR). This prevents IP spoofing and ensures your Whitelists/Blacklists actually work.

3. Stopping User Enumeration

Hackers often use ?author=1 or the REST API (/wp/v2/users) to harvest your usernames before launching a brute-force attack. This plugin intercepts and blocks these enumeration attempts at the template_redirect level.

4. Zero Bloat, Zero External Calls

  • No frontend JavaScript.
  • No external API calls (except fetching Cloudflare IPs once a week).
  • No database bloat (login logs auto-clean to keep only the last 300 entries).

The Result

Since deploying this on my own site, the noise has completely stopped. No more fake admins, no more password resets, and no more backdoors. My site is finally quiet, and my PageSpeed scores remain perfect.

Open Source & Free

I am sharing this with the community because I know how frustrating these attacks are. The plugin is currently awaiting review on the official WordPress.org repository, but the full source code and a direct download are available right now.

Check it out here:

I would love to hear your thoughts, code reviews, or any security edge cases I might have missed. Let's discuss in the comments!

Top comments (0)