Mrsea Login

Mrsea Login brings a green-and-ivory design to the WordPress login page and lets site administrators choose a custom login URL. Users can add an extra verification step with a time-based authenticator app.

Login design

• Responsive desktop and mobile layouts.
• Readable form guidance, keyboard focus styles and password visibility control.
• Headings for login, registration and password-reset screens.
• Uses your existing site title. No remote fonts are loaded.

Custom login URL

• Choose your login slug under Settings > Mrsea Login.
• Redirect visitors away from the default login routes.
• Preserve normal password reset and registration routes through the custom URL.
• Changing the URL reduces exposure of the default route; it is not a replacement for authentication or other site security.

Optional two-factor authentication

• Compatible with Google Authenticator and standard TOTP apps using SHA-1, six digits and 30-second intervals.
• Scan a locally generated QR code or enter the setup key manually.
• Verify a code before protection is enabled for the account.
• Ten one-use recovery codes, with password-and-code verification to regenerate them.
• Encrypted authenticator secrets and hashed recovery codes.
• Retry limits and protections against reusing an accepted code.
• Existing enrollments and recovery codes are retained when updating from version 1.2.0.

Two-factor protection is optional and configured per account. Installing the plugin alone does not enable it for all users. HTTPS and PHP OpenSSL with AES-256-GCM support are required for enrollment.

Privacy and external services

Mrsea Login does not use a Google API, send setup secrets to a QR service, or load a remote QR library. The QR code is rendered in the user’s browser using bundled JavaScript. The plugin adds no analytics or telemetry.

The plugin stores the login/redirect slugs in options and the encrypted authenticator secret, last accepted time step and hashed recovery codes in user metadata. Pending setup data expires after ten minutes. Retry counters expire after five minutes. Short-lived database lock rows serialize security changes and are removed after use; abandoned locks can be recovered after sixty seconds.

Deactivation stops Mrsea Login’s protections. Uninstalling does not automatically erase enrollment data or settings; this supports reinstallation without silently removing saved security configuration. A verified site administrator can remove an account’s _mrsea_login_two_factor user-meta entry when intentionally resetting its enrollment. Do not remove another user’s security settings without identity verification.

Compatibility and security boundaries

• Back up the site and bookmark the custom URL before enabling or changing settings.
• Enabling 2FA signs out the user’s other browser sessions.
• Application passwords, including existing ones, are unavailable for enrolled accounts while 2FA is on. Review integrations before enabling. Disabling 2FA makes those application passwords available again.
• Other forms using wp_authenticate/wp_signon must provide the mrsea_login_otp field for enrolled users. Password-only attempts fail.
• SSO or membership plugins that issue login cookies without WordPress authentication filters are outside this enforcement. Test compatibility first.
• Keep server and phone clocks synchronized. Accepted clock skew is one 30-second step in either direction. A used code cannot be reused, including the enrollment code.
• WordPress authentication salts are used for secret encryption. Back up wp-config.php securely. Changing salts requires authenticator re-enrollment; saved recovery codes still work.
• Password resets do not remove 2FA. Logged-in sessions do not request a new code on every page load.
• This plugin is not a firewall, malware scanner or guarantee against account compromise.

Google Authenticator is a trademark of Google LLC. Mrsea Login is an independent plugin and is not affiliated with or endorsed by Google or WordPress.

Moving from the previous plugin name

Mrsea Login is the renamed continuation of the earlier 1.3.x plugin.
Back up your site and keep an administrator session open. Install Mrsea Login,
then deactivate the old plugin and activate Mrsea Login. Do not run both.
Version 1.4.1 moves custom options and user metadata to the unique mrsea_login
prefix. Existing login slugs, encrypted secrets and recovery codes are imported
from the privately distributed predecessor when first needed.
Do not change WordPress salts during migration. Test in a private window.
If the previous plugin is still active, Mrsea Login pauses instead of running
its login hooks. A warning appears in the dashboard.

Credits

Mrsea Login by Seyi Aluko, licensed under GPLv2 or later.
Bundled qrcode-generator 2.0.4 by Kazuhiko Arase, MIT licensed.
Source: https://github.com/kazuhikoarase/qrcode-generator
The bundled js/qrcode.js is readable source; no build step is required.
Its license is included in js/LICENSE-qrcode.txt.