=== XO Security ===
Contributors: ishitaka
Tags: security, login, pingback, xmlrpc, rest, rest-api
Requires at least: 4.6
Tested up to: 5.8
Requires PHP: 5.6
Stable tag: 3.1.2
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

XO Security is a plugin to enhance login related security.

== Description ==

XO Security is a plugin to enhance login related security.
This plugin does not write to .htaccess file. Besides Apache, LiteSpeed, Nginx and IIS also work.

= Functions =

* Record login log.
* Limit login attempts.
* Login Alert.
* Add Captcha to the login form and comment form.
* Change the URL of the login page. (WordPress multisite subdomain type is not supported).
* Disable login by mail address.
* Disable login by user name.
* Change login error message.
* Disable XML-RPC and XML-RPC Pingback.
* Disable REST API.
* Change REST API URL prefix.
* Disable author archive page.
* Remove comment author class of comments list.
* WordPress multisite support.
* WooCommerce login page protection.
* Anti-spam comment.
* Hide WordPress version information.
* Edit the author slug.
* Disable RSS and Atom feeds.

== Installation ==

1. Upload the `XO-Security` folder to the `/wp-content/plugins/` directory.
2. Activate the plugin through the Plugins menu in WordPress.
3. Go to "Settings" -> "XO Security" and customize behaviour as needed.

== Screenshots ==

1. Login log page.
2. Status page.
3. Login setting page.
4. Profile page.

== Frequently Asked Questions ==

= Login page is not displayed. =

Please initialize the settings.

* In wp_options table, the value of the option_name field (column) is to remove the record of "xo_security_options".
* If you have set the login page, please delete the file.

= The CAPTCHA is not displayed. =

Please install mbstring and GD module.

== Changelog ==

= 3.1.2 =

* Enhanced login log recording.
* Added an option to set the default display method of the login log.

= 3.1.1 =

* Fixed a bug where CAPTCHA was ignored and login was possible when PHP session was not available. (Thanks to Jazz@ifNoob)

= 3.1.0 =

* In the case of WordPress multisite, the log is recorded for each site.
* Added the ability to disable RSS and Atom feeds.

= 3.0.0 =

* Added the editing function of the author slug. 
* Disabled auto-completion for CAPTCHA input fields.

= 2.9.0 =

* Added the ability to hide WordPress version information.

= 2.8.0 =

* Added the ability to block spam comment.

= 2.7.0 =

* Restructured the settings page.
* Added the function to customize the login form.

= 2.6.0 =
* Changed to remove the standard sitemap user provider when disabling the author archive.

= 2.5.0 =

* Added login type column to login log.

= 2.4.0 =

* Added the option to select the method of acquiring the IP address.

= 2.3.0 =

* Added a feature to disable login by user name and enable login by email only.

= 2.1.3 =

* Fixed a bug that could slow down the display of the admin page. (Thanks to mocchii)

= 2.1.0 =

* Added function to display site information.

= 2.0.0 =

* Added option to change login error message.
* Added option to disable login by mail address.

= 1.5.3 =

* Fixed XSS vulnerability.

= 1.0.0 =

* Initial release.