Everything You Need to Know

Neksio Login & File Security is a WordPress plugin that provides comprehensive login protection and file integrity monitoring. It combines two-factor authentication (2FA) with file system monitoring to help site administrators protect user accounts and detect unauthorized changes to critical WordPress files like wp-config.php and .htaccess.

Neksio Login & File Security is designed for bloggers, content creators, business websites, WooCommerce stores, marketing agencies, WordPress developers, and multisite networks. Whether you manage a personal blog or a large e-commerce store, the plugin provides essential security features.

Neksio Login & File Security provides multiple layers of security that passwords alone cannot offer: Two-Factor Authentication (2FA), File Integrity Monitoring, Custom Login URL, IP Blocking, and a Security Dashboard. Every feature was built from lessons learned during real production incident recovery.

The plugin addresses brute force attacks, stolen credentials, file tampering, exposed login pages, and unknown device access through rate limiting, two-factor authentication, integrity monitoring, custom login URL, and trusted devices features.

Yes. The plugin is designed to be user-friendly with easy setup, simple 2FA QR code scanning, a clear dashboard, and comprehensive documentation. Installation takes minutes and all features are well-documented.

You can install the plugin from WordPress Admin (Plugins → Add New, search for "Neksio Login & File Security") or manually upload the neksio-login-file-security folder to /wp-content/plugins/. After activation, navigate to the plugin settings to configure.

• WordPress: 6.0 or higher
• PHP: 7.4 or higher (optimized for PHP 8.1+)
• Database: MySQL 5.6+ or MariaDB 10.1+

Yes. The plugin fully supports WordPress Multisite networks. Network administrators can configure settings network-wide or allow individual sites to manage their own settings. All features work across the entire network.

No. The plugin requires PHP 7.4 or higher and is fully compatible with PHP 8.0, 8.1, 8.2, and 8.3+. For PHP 8.1+, QR codes use a native PHP library. For PHP 7.4-8.0, a JavaScript fallback is used.

Yes. All settings are preserved during updates, database tables are updated automatically, and no data loss occurs. We recommend taking a backup before any update as a standard security practice.

Two-Factor Authentication adds an extra layer of security to your WordPress login. After entering your username and password, you must also enter a temporary 6-digit code from your authenticator app. Codes are generated every 30 seconds using the TOTP standard.

The plugin supports any TOTP-compatible authenticator app including Google Authenticator, Microsoft Authenticator, Authy, LastPass Authenticator, 1Password, and Bitwarden.

Open your authenticator app, select the option to add a new account, scan the QR code displayed on screen with your device's camera, and enter the 6-digit code generated by the app to verify setup. You can also manually enter the setup key if you cannot scan the QR code.

If you lose your authenticator device, you can use one of your recovery codes to regain access. Each code can be used only once. If you have used all recovery codes, a site administrator can disable 2FA for your account from the Users screen.

Recovery codes are backup access codes generated when you enable 2FA. 10 codes are generated each time and stored as secure hashes. Each code can be used once to bypass 2FA. You can regenerate new codes at any time.

Yes. You can disable 2FA from your profile page (Users → Your Profile). When you disable 2FA, your TOTP secret and recovery codes are removed. A confirmation email is sent to your account email address.

Yes. You can regenerate new recovery codes from your profile page. Click the "Regenerate Recovery Codes" button and new codes will be generated. Old recovery codes will no longer work. A confirmation email is sent when codes are regenerated.

Trusted Devices remembers authenticated browsers so you don't need to enter 2FA codes every time. Devices are remembered for 30 days using secure, HttpOnly cookies with SameSite=Lax. You can view and remove trusted devices from your profile.

Trusted devices are remembered for 30 days from the last verification. After 30 days, you will need to verify with 2FA again. You can remove a device manually at any time.

Yes. You can remove trusted devices from your profile page. Go to Users → Your Profile, find the Trusted Devices section, and click the remove button next to the device you want to remove.

Yes. Cookies are marked as HttpOnly and Secure with SameSite=Lax protection. Each device is uniquely identified and device tokens are stored as hashes. If a device is compromised, you can remove it from your profile page.

Changing the default login URL reduces brute force attacks (automated bots target /wp-login.php), hides your login page from attackers, and can reduce up to 90% of automated login attempts. Your custom URL is only known to you and your authorized users.

Navigate to Neksio Login & File Security in the admin menu, go to the Login Security tab, enter your desired custom login slug, and save your settings. For example, if you enter "secure-access", your login URL will be https://yoursite.com/secure-access/.

If you forget your custom login URL, you can use the secret fallback URL provided during setup or the emergency access key for administrator recovery. Both are generated automatically and should be stored securely.

Yes. Navigate to the Login Security tab, clear the custom login URL field, and save your settings. After restoring, /wp-login.php will be accessible again.

Login protection works through rate limiting (configurable limits on login attempts), automatic lockout (IPs are locked out after too many failed attempts), IP blocking (manual and automatic), and attack classification (detects brute force, enumeration, and other attack types).

Yes. The plugin stops brute-force attacks through rate limiting, automatic blocking after exceeding limits, attack classification, and persistent blocks. You can customize lockout thresholds in the plugin settings.

Each failed attempt is logged with timestamp and IP. After a configurable number of failures, the IP is blocked. Optional email notifications are available, and failed login statistics are shown in the dashboard.

Yes. All lockout settings are configurable including failure threshold, lockout duration, rate limit, and exclusions. These settings can be adjusted from the Login Security tab in the plugin settings.

The Integrity Monitor tracks wp-config.php, .htaccess, unknown PHP files in the WordPress root, .htaccess backup files, and file permission changes.

Yes. wp-config.php is monitored in real-time. You receive email alerts when changes are detected, can review what was changed, and with Pro you can automatically restore the trusted version.

Yes. .htaccess is monitored for unauthorized modifications including rewrite rule injection, access control changes, and backup file detection. Email alerts are sent when changes are detected.

File changes are detected through integrity checks (file hashes are compared), real-time monitoring, unknown file scans of the root directory, and permission audits.

Yes. Email alerts are sent for wp-config.php modifications, .htaccess modifications, unknown PHP files detected, and dangerous file permission changes. Rate limiting (1 email per IP/hour, 5 per day) prevents flooding.

Yes. All file changes are logged in the Security Events Log with timestamps, change details, and filtering capabilities. You can review changes before approving or reverting them.

Emails are sent for recovery codes requests, critical file changes (wp-config.php, .htaccess), IP blocks, 2FA setup changes, and optional failed login notifications. All emails include rate limiting (1 email per IP/hour).

Yes. You can customize notification preferences in the Email Settings page by enabling or disabling specific notification types and configuring recipients. Security-critical notifications like file changes cannot be disabled.

File Integrity Alerts (wp-config.php, .htaccess, unknown files), IP Block Alerts (brute force, enumeration, XML-RPC, URL scanning), 2FA Notifications (enabled/disabled, codes regenerated), and Failed Login Alerts (configurable threshold).

The Security Dashboard provides security score, login activity (successful and failed), blocked IPs with attack classification, security events with filtering, trusted devices inventory, and top threats overview.

Yes. The Security Events page provides complete history with filtering by event type, date range, or user. Click on any event for more information, and export logs for external analysis.

Yes. You can export security events and login logs as CSV files for easy analysis. Export blocked IP records as well. Data retention periods are configurable in the settings.

Yes. The plugin supports role-based 2FA enforcement. Select which user roles must enable 2FA, configure a grace period for new users, and administrators can see 2FA status in the Users screen.

Yes. Role-based settings allow granular control including which roles must use 2FA, different grace periods for different roles, and exemptions for specific users or roles.

No. The plugin is optimized for performance with minimal overhead, efficient monitoring, no frontend impact, and optimized database queries. Most users report no noticeable impact on page load times.

The plugin uses no external APIs for core functionality. QR Code generation is 100% local, all authentication is local, emails use wp_mail(), and GeoIP lookup uses ip-api.com only when viewing IP intelligence.

QR codes are generated 100% locally. PHP 8.1+ uses the native chillerlan/php-qrcode library. PHP 7.4-8.0 uses the qrcodejs JavaScript library. No data is sent to any external server for QR code generation.

No. The plugin has no frontend scripts (most features run in admin), lightweight CSS/JS, no render-blocking scripts, and efficient database queries with proper indexing.

The plugin stores data locally in your WordPress database including user meta (2FA status, encrypted TOTP secrets), custom tables (recovery code hashes, trusted devices, logs, events, IP blacklist), and options (plugin settings). IP address storage is optional.

No. The plugin does not automatically transmit data to external servers. IP Intelligence links open only when clicked by the user, and QR generation is 100% local with no external calls.

All plugin data is stored locally in your WordPress database. TOTP secrets are encrypted at rest and recovery codes are stored as hashes only. Configurable retention periods are available for logs and events.

Yes. Data is stored locally, IP storage is optional, configurable retention periods are available, data can be deleted through Uninstall settings, and no data is sent to external servers without user action. Sensitive data is encrypted.

Yes. The plugin is fully compatible with WooCommerce, protects store owner and administrator accounts, and does not interfere with WooCommerce functionality or login/checkout flows.

Yes. The plugin works seamlessly with Elementor and other page builders with no conflicts with frontend rendering and no effect on Elementor's functionality.

Yes. The plugin fully supports WordPress Multisite networks with network-wide settings or per-site configuration. All features work across the entire network.

Yes. The plugin requires PHP 7.4 or higher and is fully compatible with PHP 7.4, 8.0, 8.1, 8.2, and 8.3+. PHP 8.1+ uses native QR code library, PHP 7.4-8.0 uses JavaScript QR code fallback.

Yes. The plugin is tested up to WordPress 6.7, regularly updated to support new WordPress releases, uses WordPress APIs and hooks, and makes no core file modifications.

Use a recovery code instead of the 2FA code, check your custom login URL, use the fallback URL, or contact support. A site administrator can also disable 2FA for your account from the Users screen.

Use a recovery code, contact an administrator to disable 2FA for your account, or set up 2FA again with a new device after regaining access. Store recovery codes in a secure location.

Check the format (case-sensitive), check if the code has been used (each code can only be used once), regenerate new codes from your profile, or contact an administrator for help.

Check PHP version (8.1+ requires gd extension, 7.4-8.0 requires JavaScript enabled), check browser console for errors, use the manual setup key, or try a different browser.

Check spam folder, check SMTP configuration, check rate limiting (1 per IP per hour), and verify notification settings. Consider using an SMTP plugin like WP Mail SMTP for reliable delivery.

Contact support via email at support@neksiotool.com, through the WordPress.org forums, or visit the documentation and website. We aim to respond within 24-48 hours.

Report bugs through the WordPress.org forums, via email with "BUG" in the subject, or on GitHub (coming soon). Include steps to reproduce, WordPress version, PHP version, and relevant error messages.

Submit feature requests via email with "FEATURE" in the subject, through the WordPress.org forums, or on GitHub (coming soon). Provide as much detail as possible about your use case and desired functionality.

Yes. The plugin follows WordPress coding standards, uses hooks and filters for extensibility, uses WordPress database APIs, and makes no core file modifications. Developers can extend the plugin's functionality.

Yes. The plugin is fully translation ready using WordPress translation APIs. All strings are internationalized, translation files are included, and community translations are welcome.

Yes. The plugin is licensed under the GNU General Public License v2 or later (GPLv2+). You can use it on unlimited websites, modify the code, redistribute it, and use it in commercial projects.

Yes. The plugin is developer friendly with numerous hooks and filters for customization, well-documented code, modular class structure, and follows WordPress security best practices. Developers can extend functionality or integrate with other systems.