Active installationsNewAdoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records Zashita 24/7 Security: Custom Login URL & Core Integrity version 1.0.2 as active, updated 5d ago and tested up to WordPress 7.1.
Overview
About this plugin
Zashita 24/7 (Russian for “protection 24/7”) closes the most common doors bots knock on every day. The admin interface is in Russian.
Custom login URL
Replace wp-login.php with your own address, for example example.com/in-k7m2x9pq/.
Visitors who open wp-login.php or /wp-admin/ without being logged in get the theme’s “not found” page.
Log out, lost password, password reset, registration and the links in WordPress emails keep working at the new address.
Forms that use admin-ajax.php or admin-post.php, the REST API, WP-Cron and the WooCommerce account page are not affected.
The password form of protected posts stays on wp-login.php so the new address is not shown to visitors.
No core files or.htaccess are modified. Deactivate the plugin and wp-login.php works again.
The new address is emailed to the site administrator when it changes.
Lost the address? Add define( 'ZSHT_LOGIN_URL_OFF', true ); to wp-config.php, or rename the plugin folder over FTP.
Core integrity check
Compares every file in wp-admin and wp-includes with the official checksums from WordPress.org for your version and locale.
Lists modified, missing and unexpected files, including PHP files in the site root that are not part of WordPress.
Login log
Successful and failed logins with date, username, IP address, browser and method (login form, XML-RPC, REST API).
Records are deleted automatically after 7–90 days (30 by default). Suggested privacy policy text is added to the WordPress privacy guide.
Security checklist
PHP version, file editor, public debug.log, XML-RPC, visible usernames and the login URL — what is at risk and why.
ru. It adds a malware scanner, quarantine, brute-force protection, hardening and notifications. This plugin works fully on its own and contains no license checks or locked features.
External services
org API.
Service: WordPress.org API (api.wordpress.org), endpoint core/checksums/1.0/.
What is sent: the installed WordPress version and locale, as part of a standard request made by the WordPress function get_core_checksums(). No personal data and no site files are sent.
When: only when an administrator clicks “Check core files”.
Terms of use: https://wordpress.org/about/privacy/ (WordPress.org privacy policy, which covers API requests).
log is publicly accessible. No third-party service is involved.
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
hide login
login log
login url
integrity
security
Compatibility & maintenance
Compatibility & maintenance
Tested with WP 7.1
Marked as tested with the current WordPress 7.1 release.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to7.1
Minimum requirementsWordPress 6.2 · PHP 7.4
Update activity29 Oct 20265d ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
No tracked version or compatibility changes have been recorded by WP PlugIndex yet.
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
