Complete Documentation

🚀 5-Step Setup

📦 System Requirements

• WordPress: 6.0 or higher
• PHP: 7.4 or higher (optimized for PHP 8.1+)
• Database: MySQL 5.6+ or MariaDB 10.1+
• Memory: Minimum 64MB recommended

📥 Installation Methods

Method 1: WordPress Admin (Recommended)

• Go to Plugins → Add New
• Search for "Neksio Login & File Security"
• Click "Install Now" then "Activate"

Method 2: Manual Upload

• Download the plugin from WordPress.org
• Upload neksio-login-file-security folder to /wp-content/plugins/
• Activate from Plugins screen

🌐 Multisite Installation

• Network Activate: Network activate the plugin for site-wide security
• Per-Site Activate: Activate only on specific sites
• Network Settings: Configure default settings for all sites
• Per-Site Override: Allow individual sites to customize settings

🔐 Two-Factor Authentication Settings

• Enable 2FA: Users → Your Profile → Enable 2FA
• Scan QR Code: Use any TOTP-compatible authenticator app
• Recovery Codes: Save the generated codes securely
• Trusted Devices: Remember browsers for 30 days

🔗 Custom Login URL Settings

• Custom Slug: Enter a unique login URL (e.g., "secure-access")
• Fallback URL: Auto-generated secret URL for emergency access
• Emergency Key: A second recovery method for administrators

🛡️ Login Protection Settings

• Rate Limit: Maximum login attempts per IP
• Lockout Duration: How long an IP is blocked
• Failure Threshold: Number of failures before lockout
• IP Whitelist: Exclude trusted IPs from blocking

📁 File Monitoring Settings

• Critical Files: wp-config.php, .htaccess, etc.
• Unknown Files: Scan root directory for suspicious PHP files
• Backup Files: Detect exposed .htaccess.bak, .htaccess.old
• Permission Monitoring: Track file permission changes

📧 Email Notification Settings

• Alert Types: File changes, IP blocks, 2FA events, failed logins
• Recipients: Configure who receives each notification
• Rate Limiting: 1 email per IP/hour, 5 per day
• Test Email: Send a test email to verify configuration

🔐 Two-Factor Authentication

How to enable 2FA:

• Go to Users → Your Profile
• Click "Enable Two-Factor Authentication"
• Scan the QR code with your authenticator app
• Enter the 6-digit code to verify setup
• Save your recovery codes

🔑 Recovery Codes

How to use recovery codes:

• When 2FA code is unavailable, click "Use Recovery Code"
• Enter one of your saved recovery codes
• Each code can only be used once
• Regenerate new codes from your profile

📱 Trusted Devices

How to manage trusted devices:

• Devices are automatically added when you verify 2FA
• Each device is trusted for 30 days
• View and remove devices from your profile
• Removing a device requires 2FA verification on next login

🔗 Custom Login URL

How to set a custom login URL:

• Go to Neksio Login & File Security → Login Security
• Enter your custom slug (e.g., "secure-admin")
• Save settings
• Access your login at https://yoursite.com/secure-admin/

🛡️ Login Rate Limiting

How to configure rate limiting:

• Go to Neksio Login & File Security → Login Security
• Set the maximum login attempts per IP
• Set the lockout duration
• Configure failure threshold
• IPs are automatically blocked after exceeding limits

🚫 IP Blocking

How to manage IP blocks:

• Automatic Blocking: IPs are blocked after failed login attempts
• Manual Blocking: Block specific IPs from IP Management page
• Attack Classification: View attack type for each blocked IP
• GeoIP Data: See country and city for blocked IPs

📁 File Integrity Monitoring

How to monitor critical files:

• Monitored Files: wp-config.php, .htaccess, unknown PHP files
• Detected Changes: File modifications trigger email alerts
• Review Changes: View all changes in Security Events log
• Auto-Revert (Pro): Automatically restore trusted versions

📊 Security Dashboard

What you can see:

• Security Score: Overall security health (0-100)
• Login Activity: Successful and failed attempts
• Blocked IPs: List with attack classification
• Security Events: Filterable event history
• Trusted Devices: Inventory of all trusted devices

👥 Role-Based 2FA Enforcement

How to enforce 2FA for roles:

• Go to Neksio Login & File Security → Role-Based 2FA
• Select which roles must use 2FA
• Set a grace period for new users
• View 2FA status in Users screen

🔐 Cannot Log In

• Use Recovery Code: Enter a recovery code instead of the 2FA code
• Check Custom URL: Ensure you're using the correct login URL
• Use Fallback URL: Access the secret fallback URL
• Contact Administrator: An admin can disable 2FA for your account

📱 Lost Authenticator Device

• Use one of your recovery codes
• Contact a site administrator to disable 2FA
• Set up 2FA again with a new device

❌ Recovery Codes Not Working

• Check that codes are entered correctly (case-sensitive)
• Each code can only be used once
• Regenerate new codes from your profile
• Contact administrator if issue persists

📷 QR Code Not Showing

• PHP 8.1+: Ensure gd extension is installed
• PHP 7.4-8.0: Ensure JavaScript is enabled
• Use the manual setup key below the QR code
• Try a different browser

📧 Emails Not Arriving

• Check spam folder
• Check SMTP configuration (consider using WP Mail SMTP)
• Check rate limiting (1 email per IP/hour)
• Verify notification settings in plugin

⚡ Performance Issues

• Minimal Impact: Plugin is optimized for performance
• No Frontend Scripts: Most features run only in admin
• Database Optimization: Queries are optimized and cached
• Check PHP Version: PHP 8.1+ is recommended

🔌 Hooks and Filters

Available Hooks:

• nlfs_before_2fa_verify - Run before 2FA verification
• nlfs_after_2fa_verify - Run after 2FA verification
• nlfs_file_change_detected - When a file change is detected
• nlfs_ip_blocked - When an IP is blocked

Available Filters:

• nlfs_2fa_secret_length - Modify TOTP secret length
• nlfs_rate_limit_threshold - Modify rate limit threshold
• nlfs_block_duration - Modify IP block duration
• nlfs_trusted_device_duration - Modify trusted device duration

📚 Developer Best Practices

• Use WordPress APIs: Follow WordPress coding standards
• Hooks and Filters: Use hooks for extensibility
• Security: Validate and sanitize all inputs
• Performance: Cache database queries where possible
• Testing: Test with different PHP versions

📋 v2.3.0 (Current)

• Added hybrid QR code generation (PHP 8.1+ uses native library, PHP 7.4-8.0 uses JavaScript)
• Improved PHP version compatibility across all hosting environments
• Removed all external API dependencies for QR generation
• Enhanced file integrity monitoring with real-time activity log
• Added attack type classification for blocked IPs
• Added comprehensive email notification system with rate limiting
• Improved security dashboard with comprehensive statistics
• Fixed timezone display issues
• Tested with WordPress 6.7

📋 v2.2.0

• Renamed plugin to "Neksio Login & File Security" for clarity
• Continued migration to the new plugin naming convention and namespace
• Maintained backward compatibility with existing database keys and nonces
• Added comprehensive security score calculation
• Improved performance and reduced database queries

📋 v2.1.0

• Added Integrity Monitor for critical file protection
• Added real-time monitoring for wp-config.php and .htaccess
• Added unknown PHP file detection in WordPress root
• Added .htaccess backup file detection
• Added file permission monitoring

📧 Contact Support

• Email: support@neksiotool.com
• WordPress Forums: WordPress.org Support
• Response Time: 24-48 hours (business days)

📚 Additional Resources

• Frequently Asked Questions
• Security Blog
• Changelog
• Development Roadmap

🐛 Report Issues

• Bug Reports: Include steps to reproduce, WordPress version, PHP version
• Feature Requests: Describe your use case and desired functionality
• Security Issues: Please report sensitive issues via email