Brute-force attacks on WordPress logins are constant. Millions of requests a day hammer the wp-login.php endpoint of every site on the internet, and most of those attackers are doing the same thing: trying to get into an administrator account. They only need one weak password, one reused credential, or one exposed dashboard URL to win.
The EDZNET Security Guard plugin is our answer to that threat. It is a hardening plugin, not a firewall: instead of bolting on a layer that scans traffic, it changes the way your admin accounts themselves behave, so the techniques attackers rely on stop working entirely.
What EDZNET Security Guard Does
Two-Factor Authentication for Administrators
Every administrator account is protected with TOTP two-factor authentication (RFC 6238) — the same standard used by Google Authenticator, Authy, 1Password, and Microsoft Authenticator. Once enabled, a password on its own is no longer enough: the attacker would also need the six-digit code that only the account holder's phone produces at that exact moment. Stolen passwords by themselves become useless.
Block New Administrator Accounts
Attackers who manage to compromise a lower-privilege account often try to quietly promote themselves or create a fresh admin user. Security Guard refuses attempts to create new administrator accounts, closing that well-worn privilege-escalation path.
Refuse URL-Credential Logins
Some malicious tools attempt to log in by feeding credentials through the URL itself. Security Guard detects these requests and returns 403 Forbidden before they reach the authentication layer.
Admin Login Notifications
Every successful admin login triggers an email notification, so you know the moment anyone — including an attacker who somehow got through — signs in. Suspicious activity becomes visible immediately rather than after the damage is done.
Locked to the First Administrator
The plugin locks administrative control to the original site owner. That single measure means a new site owner, a reseller, or an "administrator" created later can never redirect, disable, or claim the security of the installation — the first administrator is the last word.
Click to Block: Instant Account Recovery
When you do spot a compromised account, Security Guard lets you disable that account with one click from the admin area. The compromised login is cut off instantly, protecting the rest of the site while you investigate and reset credentials. The first administrator can never be blocked — an intentional safeguard that prevents someone from locking you out of your own site.
Beyond Accounts: Comments and Content
Security Guard also tidies the two most common spam-bait areas of a WordPress site:
- Comment controls — disable comments globally, force comments closed on existing posts, or clear pending spam comments in one action
- Front-end content tuning — hide post authors, hide post dates, and remove the "comments are closed" text, trimming the metadata footprints that scrapers and spam bots use to profile your site
Pairs Naturally With EDZNET Geolocation
Security Guard was built to work alongside the EDZNET Geolocation plugin. Together they give you two-factor protection on the account side and country-level access control on the network side — so an attacker in a hostile country is stopped even before they reach the login form.
Frequently Asked Questions
Will two-factor authentication annoy my other administrators?
It adds one extra step to their login — open the authenticator app, type six digits. That is a small cost compared with the risk of a single compromised admin account taking down the whole site.
Could it lock me out of my own site?
The first administrator account is deliberately protected: it cannot be blocked by the account controls, and ensuring you have that account's authenticator app set up is the one setup task you should not skip.
Does it slow down the site for visitors?
No. Every feature operates on the login and admin flows. The public-facing site runs at full speed.
Is it compatible with other security plugins?
Yes. It focuses on admin-account hardening rather than traffic scanning, so it complements rather than conflicts with firewall and malware-scanner plugins.
Download EDZNET Security Guard Pair it with EDZNET Geolocation
