Neksio Login & File Security

Description

Neksio Login & File Security provides comprehensive login protection and file integrity monitoring for WordPress websites. The plugin combines two-factor authentication (2FA) with file system monitoring to help site administrators protect user accounts and detect unauthorized changes to critical WordPress files.

Key Features

• Two-Factor Authentication (TOTP)
• Recovery Codes
• Trusted Devices
• Custom Login URL
• Login Rate Limiting
• IP Blocking
• File Integrity Monitoring
• Security Dashboard
• Security Event Logs
• Email Notifications
• Role-Based 2FA Enforcement
• Emergency Access
• Data Management

Login Protection

The plugin implements multiple layers of login security:

• Two-Factor Authentication (TOTP) – Time-based one-time passwords compatible with Google Authenticator, Microsoft Authenticator, Authy, 1Password, and Bitwarden
• Recovery Codes – Backup access codes generated when 2FA is enabled, stored as secure hashes
• Trusted Devices – Remember authenticated browsers for 30 days with secure, HttpOnly cookies
• Custom Login URL – Replace the default wp-login.php path with a custom slug
• Rate Limiting – Configurable limits on login attempts with automatic lockout
• IP Blocking – Manual and automatic blocking of suspicious IP addresses

File Integrity Monitoring

The Integrity Monitor tracks changes to critical WordPress files:

• Critical File Protection – Monitor wp-config.php and .htaccess for unauthorized modifications
• Unknown File Detection – Identify suspicious PHP files in the WordPress root directory
• Backup File Detection – Find exposed .htaccess backup files (.htaccess.bak, .htaccess.old)
• Permission Monitoring – Track file permission changes that may indicate compromise
• Real-Time Activity Log – View security events with timestamps and details

Security Dashboard

A centralized dashboard provides visibility into site security:

• Security score calculation based on configured protections
• Login activity tracking (successful and failed attempts)
• Blocked IP addresses and attack classification
• Security event history with filtering
• Trusted devices inventory
• Top threats overview

Email Notifications

The plugin sends automated email notifications for critical security events:

Recovery Codes Email:
* Sent when you request to email your recovery codes
* Contains all recovery codes in HTML format
* Automatically deletes temporary storage after sending

Security Alert Emails:
Sent when critical file changes are detected:
* wp-config.php modifications
* .htaccess modifications
* Unknown PHP files in root directory
* Dangerous file permission changes

IP Block Notifications:
Sent when an IP address is blocked:
* Brute force attacks
* Username enumeration attempts
* XML-RPC attacks
* URL scanning attempts
* Includes GeoIP data (country, city, device info)

2FA Setup Notifications:
Confirmation emails when:
* 2FA is enabled for an account
* 2FA is disabled for an account
* Recovery codes are regenerated
* Recovery Code Used (when a user successfully authenticates using a backup code)

Administrative Alerts:
Sent when critical security configurations change:
* Login URL Changed (when the custom login path is updated)
* Emergency Bypass (when the administrator uses the emergency fallback URL)

Failed Login Alerts:
* Optional notifications for failed login attempts
* Configurable threshold settings

Email Features:
* Email template customization
* Test email functionality
* Configurable notification recipients
* Rate limiting to prevent email flooding (1 email per IP/hour)
* Daily limit of 5 security alert emails
* HTML formatted emails with dashboard links
* All emails sent from your WordPress installation (no external services)

Settings Documentation

The plugin provides a unified settings interface for managing security configurations:

• Enable GeoIP Lookup – Controls optional IP intelligence and geolocation data for security reports.
• Enable Tor Exit Node Detection – Controls optional detection of known Tor exit nodes during login attempts.
• Email Notifications – Customize recipients, enable/disable specific alerts, and manage notification thresholds.
• Trusted Devices – Configure expiration durations for remembered browsers and manage trusted device tokens.
• Custom Login URL – Configure a custom path to hide the default WordPress login page, including emergency bypass options.
• File Integrity Monitoring – Configure settings for monitoring critical files and directory changes.

Security Philosophy

Neksio Login & File Security follows WordPress coding standards and uses WordPress APIs whenever possible.

The plugin is designed to reduce attack surface while remaining compatible with standard WordPress installations.

It does not modify WordPress core files.

Data Storage

Plugin data remains inside your own WordPress installation.

Sensitive authentication data is encrypted before storage whenever applicable.

Local QR Generation

QR Codes are generated entirely on your own server.

No QR data is transmitted to external QR code services.

Developer Friendly

• Uses WordPress APIs
• Uses hooks and filters
• Translation ready
• WordPress coding standards
• PHP 7.4+
• GPL compatible

Accessibility

The plugin follows WordPress admin interface conventions wherever possible.

Logging

Security events are stored locally inside the WordPress database.

Retention periods are configurable.

Clean Uninstall

The plugin provides options to remove stored data during uninstall.

Compatibility

• WordPress 6.0+
• PHP 7.4+
• PHP 8.x Ready (tested with PHP 7.4 through 8.3+)
• Works with most caching plugins
• Compatible with modern TOTP authenticator applications

Additional Features

• Role-Based 2FA Enforcement – Require 2FA for specific user roles with configurable grace periods
• Email Notifications – Receive alerts for security events, failed logins, and IP blocks
• IP Intelligence – View attack patterns, geolocation data, and request counts for blocked IPs
• Data Management – Configurable retention periods for logs and automatic cleanup
• Emergency Access – Secret fallback URL and emergency access key for administrator recovery

Built for Real-World Use

This plugin was developed based on lessons learned from investigating and recovering a production WordPress website affected by unauthorized file modifications. The features address specific challenges encountered during incident response, including detecting modified configuration files, identifying injected files, and restoring trusted states.

Technical Details

• Uses only WordPress APIs and hooks – no core file modifications
• All QR codes generated locally (no external API calls)
• TOTP secrets encrypted at rest
• Recovery codes stored as hashes only
• PHP 7.4+ required, optimized for PHP 8.1+

External services

This plugin uses or connects to the following external services:

NeksioTool Assets & IP Intelligence (neksiotool.com)

• What it is and what it is used for: This plugin may connect to NeksioTool (neksiotool.com) to load custom site logos and brand images used on 2FA verification pages and plugin settings previews. It may also provide optional links to NeksioTool IP lookup tools from the IP Management dashboard.
• What data is sent and when: When an external NeksioTool logo or brand image is loaded, the user’s browser may send a standard HTTP request to NeksioTool. This request may include the browser’s IP address and HTTP user-agent as part of normal web communication. When an administrator chooses to open an external NeksioTool IP lookup link, the browser also sends a standard HTTP request to that service. The plugin does not send passwords, authentication secrets, recovery codes, or other WordPress login credentials to NeksioTool.
• Service Terms & Privacy Policy:
  • Terms of Service: https://neksiotool.com/terms-of-service/
  • Privacy Policy: https://neksiotool.com/privacy-policy/

GeoIP Geolocation Service (ip-api.com)

• What it is and what it is used for: The plugin can fetch country and city geolocation data for blocked IP addresses to display in security activity logs and IP management reports.
• What data is sent and when: Only the specific IP address being queried is sent via an HTTP GET request to ip-api.com. This feature is OPTIONAL and DISABLED by default; it only executes if the site administrator explicitly enables “Enable GeoIP Lookup” in security settings.
• Service Terms & Privacy Policy:
  • Terms of Service: https://ip-api.com/docs/legal
  • Privacy Policy: https://ip-api.com/privacy

Tor Exit Node Detection (Tor Project)

• What it is and what it is used for: The plugin can check whether incoming login requests originate from known Tor exit nodes to prevent brute-force attacks.
• What data is sent and when: An HTTP GET request is sent to check.torproject.org to fetch the public exit node list. No user data, site data, or IP addresses are sent to the Tor Project. This feature is OPTIONAL and DISABLED by default; list downloads are cached locally.
• Service Terms & Privacy Policy:
  • Terms of Service: https://support.torproject.org/
  • Privacy Policy: https://torproject.org/about/privacy_policy/

QR Code Generation

QR codes for 2FA setup are generated 100% locally using bundled libraries (chillerlan/php-qrcode or qrcodejs). No data is sent to any external server for QR code generation.

Privacy Policy

Neksio Login & File Security stores data locally in your WordPress database.

Data Stored

• User Meta: 2FA status, encrypted TOTP secrets, last verification timestamp, recovery status
• Custom Tables: Recovery code hashes, trusted device information, login logs, security events, IP blacklist, file backups
• Options: Plugin settings, custom login URLs, security codes

Cookies

The plugin uses one cookie for trusted device management:

• Name: nlfs_trusted_device
• Duration: 30 days
• Attributes: Secure, HttpOnly, SameSite=Lax

Data Retention

Configurable retention periods for:

• Login logs
• Security events
• Trusted devices (automatic cleanup after inactivity)
• IP blacklist records
• File backups

Data Removal

All plugin data can be deleted through the Uninstall settings page or by uninstalling the plugin with data removal enabled. Individual users can delete their 2FA data from their profile page.

Third-Party Services

This plugin does not automatically transmit data to external servers except under the following conditions:

• IP Intelligence Reports: Links open in a new tab only when explicitly clicked by the user. The plugin does not automatically send any data to these services.
• GeoIP Lookup: This feature is DISABLED by default. It requires explicit user opt-in via the plugin settings (“Enable GeoIP Lookup”). The plugin will NOT send any IP addresses to external servers unless the administrator actively enables this option. When enabled, it uses ip-api.com to obtain geolocation data (country/city) for blocked IPs.

QR code generation is performed 100% locally with no external API calls.

Email notifications are sent from your WordPress installation using wp_mail(). No external email services are used.

Access to Data

Only users with appropriate capabilities can access administrative data. Users can access only their own 2FA settings and recovery codes.

Data Encryption

TOTP secrets are encrypted at rest. Recovery codes are stored as hashes only.

Support

• Documentation: https://www.neksiotool.com/neksio-login-file-security/
• WordPress.org forums: https://wordpress.org/support/plugin/neksio-login-file-security/
• Email: support@neksiotool.com
• Website: https://www.neksiotool.com

Credits

• QR Code Generation (PHP 8.1+): chillerlan/php-qrcode – https://github.com/chillerlan/php-qrcode
• QR Code Generation (PHP < 8.1): qrcodejs by davidshimjs – https://github.com/davidshimjs/qrcodejs
• Icons: WordPress Dashicons
• GeoIP Service: ip-api.com – https://ip-api.com
• Tor Exit Node List: The Tor Project – https://www.torproject.org/

License

Neksio Login & File Security is licensed under the GNU General Public License v2 or later.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.