{"id":373309,"date":"2026-10-15T04:31:51","date_gmt":"2026-10-15T04:31:51","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/authsafe\/"},"modified":"2026-10-15T04:31:41","modified_gmt":"2026-10-15T04:31:41","slug":"aphonix","status":"publish","type":"plugin","link":"https:\/\/kin.wordpress.org\/plugins\/aphonix\/","author":23567844,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.1.3","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"AphoniX","header_author":"Aphonic Solutions","header_description":"AphoniX enhances your WordPress security with lightweight custom CAPTCHA protection, optional Two-Factor Authentication (2FA), login attempt IP blocking, REST user enumeration protection, and the ability to customize the wp-login.php URL. Simple, secure, and essential for any WordPress site.","assets_banners_color":"","last_updated":"2026-10-15 04:31:41","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/aphonicsolutions.com\/","header_plugin_uri":"","header_author_uri":"https:\/\/aphonicsolutions.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":60,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"aphonicsolutions","date":"2026-10-15 04:31:41","revision":3747597}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-256x25.png":{"filename":"icon-256x25.png","revision":3748063,"resolution":"256x25","location":"assets","locale":"","width":256,"height":256}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3748063,"resolution":"1","location":"assets","locale":"","width":1900,"height":902},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3748063,"resolution":"2","location":"assets","locale":"","width":1899,"height":912}},"screenshots":{"1":"WordPress login page protected with AphoniX SVG CAPTCHA.","2":"Two-Factor Authentication (2FA) verification screen.","3":"AphoniX Security Dashboard and settings management.","4":"Role-based 2FA enforcement and IP rate limiting settings.","5":"Real-time Security Activity Log with CSV export."}},"plugin_section":[],"plugin_tags":[362,25642,1945,1229,1909],"plugin_category":[44],"plugin_contributors":[286874],"plugin_business_model":[],"class_list":["post-373309","plugin","type-plugin","status-publish","hentry","plugin_tags-captcha","plugin_tags-hide-login","plugin_tags-ip-block","plugin_tags-login-security","plugin_tags-two-factor-authentication","plugin_category-discussion-and-community","plugin_contributors-aphonicsolutions","plugin_committers-aphonicsolutions"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/aphonix.svg","icon_2x":false,"generated":true},"screenshots":[{"src":"https:\/\/ps.w.org\/aphonix\/assets\/screenshot-1.png?rev=3748063","caption":"WordPress login page protected with AphoniX SVG CAPTCHA."},{"src":"https:\/\/ps.w.org\/aphonix\/assets\/screenshot-2.png?rev=3748063","caption":"Two-Factor Authentication (2FA) verification screen."}],"raw_content":"<!--section=description-->\n<p><strong>AphoniX<\/strong> is a lightweight, high-performance WordPress security plugin that protects your WordPress login page from brute force attacks, bot attempts, and unauthorized credential stuffing.<\/p>\n\n<p>AphoniX strengthens your site without bloated external services or heavy database queries. Everything is processed cleanly on your server, ensuring privacy, lightning-fast performance, and rock-solid defense.<\/p>\n\n<h3>Main Features<\/h3>\n\n<ul>\n<li><strong>Custom SVG CAPTCHA on Login<\/strong>: Adds an interference-resistant, bot-blocking SVG CAPTCHA challenge directly onto the login form.<\/li>\n<li><strong>Two-Factor Authentication (2FA)<\/strong>: Adds a secure second verification factor after successful password verification.<\/li>\n<li><strong>Google Authenticator &amp; Authy Support<\/strong>: Supports standard TOTP authentication apps (Google Authenticator, Authy, Microsoft Authenticator) with local QR code generation in your browser.<\/li>\n<li><strong>Email One-Time Password (OTP)<\/strong>: Delivers 6-digit verification codes straight to verified user emails.<\/li>\n<li><strong>Emergency Recovery Codes<\/strong>: Generates 8 one-time backup recovery codes to prevent administrator lockouts.<\/li>\n<li><strong>Email Delivery Verification Test<\/strong>: Ensures your WordPress email\/SMTP configuration delivers 2FA OTP codes properly before enforcing 2FA.<\/li>\n<li><strong>Role-Based 2FA Enforcement<\/strong>: Selectively require 2FA only for sensitive user roles like Administrators and Editors.<\/li>\n<li><strong>Login Attempt IP Blocking<\/strong>: Automatically blocks IP addresses after too many failed login, CAPTCHA, or 2FA attempts.<\/li>\n<li><strong>Rapid Attempt Detection<\/strong>: Detects and throttles automated bot attacks submitting bursts of login requests.<\/li>\n<li><strong>REST API User Enumeration Hardening<\/strong>: Stops unauthenticated hackers and bots from discovering author usernames via <code>\/wp-json\/wp\/v2\/users<\/code>.<\/li>\n<li><strong>Hide Login URL<\/strong>: Customize your <code>wp-login.php<\/code> URL slug (e.g. <code>\/my-login\/<\/code>) and redirect direct attempts to a 404 or custom page.<\/li>\n<li><strong>Security Activity Log<\/strong>: Records security events with timestamps, event types, IP addresses, and user IDs with one-click CSV export.<\/li>\n<li><strong>Generic Login Error Messages<\/strong>: Prevents username enumeration by hiding detailed login failure notices.<\/li>\n<li><strong>100% Private &amp; Self-Contained<\/strong>: No external CAPTCHA or QR-code service is used. Email OTP messages use your configured WordPress mail provider.<\/li>\n<\/ul>\n\n<h3>Third-party source and license<\/h3>\n\n<p>QRCode.js by davidshimjs, including QR Code for JavaScript by Kazuhiko Arase, is distributed under the MIT license.\nSource: https:\/\/github.com\/davidshimjs\/qrcodejs\nThe readable source and MIT license are included in assets\/js\/qrcode.js and assets\/js\/qrcode-LICENSE.txt. No build step is required.<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>CAPTCHA challenges and authentication checks are processed locally. Authenticator QR codes are generated in the browser using the bundled library. Email OTP messages are sent using wp_mail() and your configured mail provider, which processes recipient addresses and message contents.\nSecurity logs store IP addresses, user IDs, timestamps and event details locally, with a maximum of 500 entries. Authenticator secrets and hashed recovery codes are stored in WordPress user metadata. Uninstall removes plugin settings and authentication metadata.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>aphonix<\/code> folder to the <code>\/wp-content\/plugins\/<\/code> directory, or install the plugin directly through the WordPress Plugins dashboard.<\/li>\n<li>Activate <strong>AphoniX<\/strong> through the <strong>Plugins<\/strong> screen in WordPress.<\/li>\n<li>Navigate to <strong>Settings -&gt; AphoniX Settings<\/strong> to configure your security rules.<\/li>\n<li>If you enable the <strong>Hide Login URL<\/strong> feature, make sure to bookmark your new login URL before logging out.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20aphonix%20transmit%20any%20user%20secrets%20to%20third-party%20services%3F\"><h3>Does AphoniX transmit any user secrets to third-party services?<\/h3><\/dt>\n<dd><p>No. AphoniX is 100% self-contained. Two-Factor Authentication secrets and QR codes are generated locally and offline on your site. Email OTP messages are sent through your configured WordPress mail system; the mail provider processes the recipient address and message. No external CAPTCHA or QR-code service is used.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20my%20email%20server%20fails%20and%20i%20cannot%20receive%20the%202fa%20otp%3F\"><h3>What happens if my email server fails and I cannot receive the 2FA OTP?<\/h3><\/dt>\n<dd><p>AphoniX allows administrators to generate and download 8 Emergency One-Time Recovery Codes from the settings screen. Any of these codes can be entered on the 2FA prompt to gain access.<\/p><\/dd>\n<dt id=\"can%20i%20enforce%202fa%20only%20for%20administrators%3F\"><h3>Can I enforce 2FA only for Administrators?<\/h3><\/dt>\n<dd><p>Yes. Under <strong>Settings -&gt; AphoniX Settings -&gt; Role-Based 2FA Enforcement<\/strong>, you can select which roles require two-factor verification.<\/p><\/dd>\n<dt id=\"what%20should%20i%20do%20if%20i%20forget%20my%20custom%20login%20url%20slug%3F\"><h3>What should I do if I forget my custom Login URL slug?<\/h3><\/dt>\n<dd><p>If you lose access, connect to your server using SFTP, FTP, or your hosting file manager, and temporarily rename the <code>\/wp-content\/plugins\/aphonix\/<\/code> folder. This deactivates the plugin so you can log in at <code>\/wp-login.php<\/code>. Once logged in, rename the folder back to <code>aphonix<\/code> and update your settings.<\/p><\/dd>\n<dt id=\"is%20ip%20blocking%20permanent%3F\"><h3>Is IP blocking permanent?<\/h3><\/dt>\n<dd><p>No. AphoniX blocks IPs temporarily to mitigate active brute force and credential-stuffing attacks while preventing legitimate users from being locked out indefinitely.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release of AphoniX.<\/li>\n<\/ul>","raw_excerpt":"Protect WordPress login with lightweight custom CAPTCHA, Two-Factor Authentication (2FA), IP blocking, REST hardening, and custom login URL.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/373309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=373309"}],"author":[{"embeddable":true,"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/aphonicsolutions"}],"wp:attachment":[{"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=373309"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=373309"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=373309"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=373309"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=373309"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/kin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=373309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}