AphoniX

وەسف

AphoniX is a lightweight, high-performance WordPress security plugin that protects your WordPress login page from brute force attacks, bot attempts, and unauthorized credential stuffing.

AphoniX strengthens your site without bloated external services or heavy database queries. Everything is processed cleanly on your server, ensuring privacy, lightning-fast performance, and rock-solid defense.

Main Features

• Custom SVG CAPTCHA on Login: Adds an interference-resistant, bot-blocking SVG CAPTCHA challenge directly onto the login form.
• Two-Factor Authentication (2FA): Adds a secure second verification factor after successful password verification.
• Google Authenticator & Authy Support: Supports standard TOTP authentication apps (Google Authenticator, Authy, Microsoft Authenticator) with local QR code generation in your browser.
• Email One-Time Password (OTP): Delivers 6-digit verification codes straight to verified user emails.
• Emergency Recovery Codes: Generates 8 one-time backup recovery codes to prevent administrator lockouts.
• Email Delivery Verification Test: Ensures your WordPress email/SMTP configuration delivers 2FA OTP codes properly before enforcing 2FA.
• Role-Based 2FA Enforcement: Selectively require 2FA only for sensitive user roles like Administrators and Editors.
• Login Attempt IP Blocking: Automatically blocks IP addresses after too many failed login, CAPTCHA, or 2FA attempts.
• Rapid Attempt Detection: Detects and throttles automated bot attacks submitting bursts of login requests.
• REST API User Enumeration Hardening: Stops unauthenticated hackers and bots from discovering author usernames via /wp-json/wp/v2/users.
• Hide Login URL: Customize your wp-login.php URL slug (e.g. /my-login/) and redirect direct attempts to a 404 or custom page.
• Security Activity Log: Records security events with timestamps, event types, IP addresses, and user IDs with one-click CSV export.
• Generic Login Error Messages: Prevents username enumeration by hiding detailed login failure notices.
• 100% Private & Self-Contained: No external CAPTCHA or QR-code service is used. Email OTP messages use your configured WordPress mail provider.

Third-party source and license

QRCode.js by davidshimjs, including QR Code for JavaScript by Kazuhiko Arase, is distributed under the MIT license.
Source: https://github.com/davidshimjs/qrcodejs
The readable source and MIT license are included in assets/js/qrcode.js and assets/js/qrcode-LICENSE.txt. No build step is required.

Privacy

CAPTCHA challenges and authentication checks are processed locally. Authenticator QR codes are generated in the browser using the bundled library. Email OTP messages are sent using wp_mail() and your configured mail provider, which processes recipient addresses and message contents.
Security logs store IP addresses, user IDs, timestamps and event details locally, with a maximum of 500 entries. Authenticator secrets and hashed recovery codes are stored in WordPress user metadata. Uninstall removes plugin settings and authentication metadata.