I Built a 15KB WordPress Login Shield After Hackers Installed a Backdoor on My Site

说明与用途

构建了轻量级 WordPress 登录屏蔽插件，阻止暴力破解、伪管理员和后门攻击，同时保持网站性能。

问题

Hackers repeatedly reset admin passwords, created fake admin accounts, and installed a malicious backdoor plugin, compromising site security and performance.

结果

After deployment, the site experienced no further password resets, fake admin creation, or backdoor installations; performance metrics remained unchanged.

工作流

• 1. Analyze attack vectors and design a lightweight solution.
• 2. Generate short‑lived HMAC‑SHA256 signed access cookie for true URL hiding.
• 3. Validate real visitor IPs against Cloudflare IP ranges to prevent spoofing.
• 4. Intercept and block user enumeration attempts at template_redirect level.
• 5. Deploy plugin, ensuring no frontend JS, external calls, or database bloat.
• 6. Monitor and clean login logs, keeping only the last 300 entries.

证据

Since deploying this on my own site, the noise has completely stopped. No more fake admins, no more password resets, and no more backdoors.

来源

The plugin weighs in at just 15.6 KB (unzipped: 63.2 KB).

来源