Title: Mrsea Login Author: mrsea Published: 4 setembro, 2026 Last modified: 4 setembro, 2026 --- Pesquisar plugins ![](https://ps.w.org/mrsea-login/assets/banner-772x250.png?rev=3680889) ![](https://ps.w.org/mrsea-login/assets/icon-256x256.png?rev=3680889) # Mrsea Login Por [mrsea](https://profiles.wordpress.org/mrsea/) [Baixar](https://downloads.wordpress.org/plugin/mrsea-login.1.4.2.zip) * [Detalhes](https://br.wordpress.org/plugins/mrsea-login/#description) * [Avaliações](https://br.wordpress.org/plugins/mrsea-login/#reviews) * [Instalação](https://br.wordpress.org/plugins/mrsea-login/#installation) * [Desenvolvimento](https://br.wordpress.org/plugins/mrsea-login/#developers) [Suporte](https://wordpress.org/support/plugin/mrsea-login/) ## Descrição Mrsea Login brings a green-and-ivory design to the WordPress login page and lets site administrators choose a custom login URL. Users can add an extra verification step with a time-based authenticator app. **Login design** * Responsive desktop and mobile layouts. * Readable form guidance, keyboard focus styles and password visibility control. * Headings for login, registration and password-reset screens. * Uses your existing site title. No remote fonts are loaded. **Custom login URL** * Choose your login slug under Settings > Mrsea Login. * Redirect visitors away from the default login routes. * Preserve normal password reset and registration routes through the custom URL. * Changing the URL reduces exposure of the default route; it is not a replacement for authentication or other site security. **Optional two-factor authentication** * Compatible with Google Authenticator and standard TOTP apps using SHA-1, six digits and 30-second intervals. * Scan a locally generated QR code or enter the setup key manually. * Verify a code before protection is enabled for the account. * Ten one-use recovery codes, with password-and-code verification to regenerate them. * Encrypted authenticator secrets and hashed recovery codes. * Retry limits and protections against reusing an accepted code. * Existing enrollments and recovery codes are retained when updating from version 1.2.0. Two-factor protection is optional and configured per account. Installing the plugin alone does not enable it for all users. HTTPS and PHP OpenSSL with AES-256-GCM support are required for enrollment. **Privacy and external services** Mrsea Login does not use a Google API, send setup secrets to a QR service, or load a remote QR library. The QR code is rendered in the user’s browser using bundled JavaScript. The plugin adds no analytics or telemetry. The plugin stores the login/redirect slugs in options and the encrypted authenticator secret, last accepted time step and hashed recovery codes in user metadata. Pending setup data expires after ten minutes. Retry counters expire after five minutes. Short-lived database lock rows serialize security changes and are removed after use; abandoned locks can be recovered after sixty seconds. Deactivation stops Mrsea Login’s protections. Uninstalling does not automatically erase enrollment data or settings; this supports reinstallation without silently removing saved security configuration. A verified site administrator can remove an account’s `_mrsea_login_two_factor` user-meta entry when intentionally resetting its enrollment. Do not remove another user’s security settings without identity verification. **Compatibility and security boundaries** * Back up the site and bookmark the custom URL before enabling or changing settings. * Enabling 2FA signs out the user’s other browser sessions. * Application passwords, including existing ones, are unavailable for enrolled accounts while 2FA is on. Review integrations before enabling. Disabling 2FA makes those application passwords available again. * Other forms using wp_authenticate/wp_signon must provide the `mrsea_login_otp` field for enrolled users. Password-only attempts fail. * SSO or membership plugins that issue login cookies without WordPress authentication filters are outside this enforcement. Test compatibility first. * Keep server and phone clocks synchronized. Accepted clock skew is one 30-second step in either direction. A used code cannot be reused, including the enrollment code. * WordPress authentication salts are used for secret encryption. Back up wp-config. php securely. Changing salts requires authenticator re-enrollment; saved recovery codes still work. * Password resets do not remove 2FA. Logged-in sessions do not request a new code on every page load. * This plugin is not a firewall, malware scanner or guarantee against account compromise. Google Authenticator is a trademark of Google LLC. Mrsea Login is an independent plugin and is not affiliated with or endorsed by Google or WordPress. ### Moving from the previous plugin name Mrsea Login is the renamed continuation of the earlier 1.3.x plugin. Back up your site and keep an administrator session open. Install Mrsea Login, then deactivate the old plugin and activate Mrsea Login. Do not run both. Version 1.4.1 moves custom options and user metadata to the unique mrsea_login prefix. Existing login slugs, encrypted secrets and recovery codes are imported from the privately distributed predecessor when first needed. Do not change WordPress salts during migration. Test in a private window. If the previous plugin is still active, Mrsea Login pauses instead of running its login hooks. A warning appears in the dashboard. ### Credits Mrsea Login by Seyi Aluko, licensed under GPLv2 or later. Bundled qrcode-generator 2.0.4 by Kazuhiko Arase, MIT licensed. Source: https://github.com/kazuhikoarase/ qrcode-generator The bundled js/qrcode.js is readable source; no build step is required. Its license is included in js/LICENSE-qrcode.txt. ## Capturas de tela [⌊Desktop login page with the responsive design and authenticator/recovery-code field.⌉⌊Desktop login page with the responsive design and authenticator/recovery- code field.⌉[ Desktop login page with the responsive design and authenticator/recovery-code field. [⌊Mobile login page with readable guidance and stacked layout.⌉⌊Mobile login page with readable guidance and stacked layout.⌉[ Mobile login page with readable guidance and stacked layout. [⌊Custom login URL and blocked-login redirect settings.⌉⌊Custom login URL and blocked- login redirect settings.⌉[ Custom login URL and blocked-login redirect settings. [⌊QR-code and manual-key authenticator setup. The displayed QR/key belongs to a disposable demonstration account; never use it for your account.⌉⌊QR-code and manual- key authenticator setup. The displayed QR/key belongs to a disposable demonstration account; never use it for your account.⌉[ QR-code and manual-key authenticator setup. The displayed QR/key belongs to a disposable demonstration account; never use it for your account. ## Instalação 1. Upload the installable plugin ZIP through Plugins > Add New > Upload Plugin, or copy the mrsea-login directory into wp-content/plugins. 2. Activate Mrsea Login. When moving from the previous plugin name, follow the migration section below: deactivate the old plugin first. For later updates to Mrsea Login itself, choose Replace current with uploaded. 3. Visit Settings > Mrsea Login. The default slug is login. Bookmark the displayed login URL before changing it. 4. For 2FA, choose Set up two-factor authentication, or open Users > Mrsea Login Security. Accounts without user-list access use the Profile menu. 5. Enter your current password to start setup. 6. In Google Authenticator, select + > Scan a QR code. Alternatively select Enter a setup key, copy the displayed key and choose Time based. 7. Enter your password and the app’s six-digit code to verify and enable protection. 8. Save the ten recovery codes immediately. They are displayed only once. 9. Keep your current session open and test the bookmarked login URL in a private window. Wait for a fresh app code after setup. ## Perguntas frequentes ### Does everyone have to set up two-factor authentication? No. Each user enables it for their own account. There is no site-wide mandatory enrollment policy in this version. ### Do I need a Google API key or a paid service? No. Standard TOTP codes and local QR generation do not require an API key. ### Can I enter a setup key instead of scanning? Yes. Both methods are offered during setup and use the same secret. Choose Time based when entering the key manually. ### Must I scan again after updating? No. Existing working enrollments and recovery codes are preserved. QR provisioning is shown only during a new setup, not on the public login form or for already-enrolled accounts. ### What if I lose my phone? Use an unused recovery code in the login code field together with your password. Then manage recovery codes or disable and re-enroll from Mrsea Login Security. If no recovery code remains, ask your verified site administrator to reset only your enrollment. A host administrator can use `wp user meta delete USER_ID _mrsea_login_two_factor` after verifying your identity. ### How do I recover access if I forget the custom login URL? Use a trusted, logged-in administrator session to view Settings > Mrsea Login. As an emergency last resort, a verified hosting administrator can temporarily rename the mrsea-login plugin directory. This disables both hidden-login routing and 2FA enforcement for everyone, so restore security promptly. ### Why is a correct code rejected? A code may have expired, already been used, or been blocked by the retry limit. Use automatic time on your phone, wait for a fresh code and try again. After five failed attempts, wait five minutes. ### Does this version include a visual design editor? No. It provides a ready-made responsive design, not an admin editor for arbitrary colours, backgrounds or logos. ## Avaliações ![](https://secure.gravatar.com/avatar/285c4adc79bea04b10d7d370c8cbe955c3dfe6ac956a407e3d3e2f60c76e3dd7? s=60&d=retro&r=g) ### 󠀁[Simple and Powerful](https://wordpress.org/support/topic/simple-and-powerful-220/)󠁿 [nownewsng](https://profiles.wordpress.org/nownewsng/) 4 setembro, 2026 I’ve tried several plugins for this purpose, but this is by far the easiest to use. It has all the features I need without making the dashboard complicated. Great plugin and excellent performance. [ Leia a 1 avaliação ](https://wordpress.org/support/plugin/mrsea-login/reviews/) ## Colaboradores e desenvolvedores “Mrsea Login” é um programa de código aberto. As seguintes pessoas contribuíram para este plugin. Colaboradores * [ mrsea ](https://profiles.wordpress.org/mrsea/) [Traduzir o “Mrsea Login” para seu idioma.](https://translate.wordpress.org/projects/wp-plugins/mrsea-login) ### Interessado no desenvolvimento? [Navegue pelo código](https://plugins.trac.wordpress.org/browser/mrsea-login/), consulte o [repositório SVN](https://plugins.svn.wordpress.org/mrsea-login/) ou assine o [registro de desenvolvimento](https://plugins.trac.wordpress.org/log/mrsea-login/) por [RSS](https://plugins.trac.wordpress.org/log/mrsea-login/?limit=100&mode=stop_on_copy&format=rss). ## Registro de alterações #### 1.4.2 * Removed manual loading of the WordPress template loader and now allows the normal WordPress request lifecycle to render blocked-login responses. #### 1.4.1 * Replaced short custom prefixes with the unique mrsea_login prefix. * Migrates settings and authenticator enrollment data from the predecessor. #### 1.4.0 * Renamed to Mrsea Login with the mrsea-login text domain and directory. * Corrected the contributor username to mrsea. * Retained saved login and authenticator settings during the rename. * Added a guard against running alongside the previous plugin. #### 1.3.0 * Added green-and-ivory responsive login design and action-aware headings. * Improved authenticator guidance contrast and remember-me alignment. * Added local QR-code setup alongside manual entry and a copy-key button. * Preserved existing authenticator enrollment, recovery codes and hidden-login settings. #### 1.2.0 * Added optional per-user authenticator TOTP, verified enrollment and encrypted secrets. * Added ten one-use recovery codes, retry limits, verification locks and replay prevention. #### 1.1.0 * Added custom hidden login URL and blocked-login redirect settings. #### 1.0.0 * Initial custom login design. ## Meta * Versão **1.4.2** * Última atualização **1 dia atrás** * Instalações ativas **Menos de 10** * Versão do WordPress ** 6.0 ou superior ** * Testado até **7.1** * Versão do PHP ** 7.4 ou superior ** * Idioma * [English (US)](https://wordpress.org/plugins/mrsea-login/) * Tags * [Authenticator](https://br.wordpress.org/plugins/tags/authenticator/)[custom login](https://br.wordpress.org/plugins/tags/custom-login/) [hide login](https://br.wordpress.org/plugins/tags/hide-login/)[login security](https://br.wordpress.org/plugins/tags/login-security/) [two factor](https://br.wordpress.org/plugins/tags/two-factor/) * [Visualização avançada](https://br.wordpress.org/plugins/mrsea-login/advanced/) ## Classificações 5 de 5 estrelas. * [ 1 avaliação com 5 estrela ](https://wordpress.org/support/plugin/mrsea-login/reviews/?filter=5) * [ 0 avaliação com 4 estrela ](https://wordpress.org/support/plugin/mrsea-login/reviews/?filter=4) * [ 0 avaliação com 3 estrela ](https://wordpress.org/support/plugin/mrsea-login/reviews/?filter=3) * [ 0 avaliação com 2 estrela ](https://wordpress.org/support/plugin/mrsea-login/reviews/?filter=2) * [ 0 avaliação com 1 estrela ](https://wordpress.org/support/plugin/mrsea-login/reviews/?filter=1) [Sua avaliação](https://wordpress.org/support/plugin/mrsea-login/reviews/#new-post) [Ver todas avaliações](https://wordpress.org/support/plugin/mrsea-login/reviews/) ## Colaboradores * [ mrsea ](https://profiles.wordpress.org/mrsea/) ## Suporte Tem algo a dizer? Precisa de ajuda? [Ver fórum de suporte](https://wordpress.org/support/plugin/mrsea-login/)