I Built a 15KB WordPress Login Shield After Hackers Installed a Backdoor on My Site

Описание и применение

Создана легковесная защита входа в WordPress, которая блокирует брутфорс, фальшивые админы и бэкдоры, сохраняя производительность сайта.

Задача

Hackers repeatedly reset admin passwords, created fake admin accounts, and installed a malicious backdoor plugin, compromising site security and performance.

Результат

After deployment, the site experienced no further password resets, fake admin creation, or backdoor installations; performance metrics remained unchanged.

Рабочий процесс

• 1. Analyze attack vectors and design a lightweight solution.
• 2. Generate short‑lived HMAC‑SHA256 signed access cookie for true URL hiding.
• 3. Validate real visitor IPs against Cloudflare IP ranges to prevent spoofing.
• 4. Intercept and block user enumeration attempts at template_redirect level.
• 5. Deploy plugin, ensuring no frontend JS, external calls, or database bloat.
• 6. Monitor and clean login logs, keeping only the last 300 entries.

Доказательства

Since deploying this on my own site, the noise has completely stopped. No more fake admins, no more password resets, and no more backdoors.

Источник

The plugin weighs in at just 15.6 KB (unzipped: 63.2 KB).

Источник