I Built a 15KB WordPress Login Shield After Hackers Installed a Backdoor on My Site

Description and use

A lightweight WordPress login shield was built to block brute‑force attacks, fake admin accounts, and backdoors while preserving site performance.

Problem

Hackers repeatedly reset admin passwords, created fake admin accounts, and installed a malicious backdoor plugin, compromising site security and performance.

Outcome

After deployment, the site experienced no further password resets, fake admin creation, or backdoor installations; performance metrics remained unchanged.

Workflow

• 1. Analyze attack vectors and design a lightweight solution.
• 2. Generate short‑lived HMAC‑SHA256 signed access cookie for true URL hiding.
• 3. Validate real visitor IPs against Cloudflare IP ranges to prevent spoofing.
• 4. Intercept and block user enumeration attempts at template_redirect level.
• 5. Deploy plugin, ensuring no frontend JS, external calls, or database bloat.
• 6. Monitor and clean login logs, keeping only the last 300 entries.

Evidence

Since deploying this on my own site, the noise has completely stopped. No more fake admins, no more password resets, and no more backdoors.

Source

The plugin weighs in at just 15.6 KB (unzipped: 63.2 KB).

Source