Zen Login & Authentication compatibility with REEID Translate

Plugin capabilities

• Frontend login, registration, and password recovery forms that replace the default wp-login.php experience via URL rewriting (wp-login.php remains available for administrators and recovery flows).
• Security hardening on authentication forms including nonce verification, configurable rate limiting with lockout windows, and honeypot spam protection with rotating hidden fields.
• Username-enumeration hardening that blocks author scans (e.g., ?author=N) and REST /wp/v2/users listing for logged-out visitors, and collapses login errors to a neutral message.
• Optional breached-password blocking using Have I Been Pwned Pwned Passwords with k-anonymity (sending only the first 5 characters of the SHA-1 hash) and cached requests; fails open if the service is unreachable.
• Optional bot protection using Cloudflare Turnstile on login/registration/lost-password forms, including server-side verification via Cloudflare siteverify endpoint.
• Optional XML-RPC lockdown to disable XML-RPC to reduce brute-force amplification and pingback abuse.
• Optional per-user two-factor authentication using app-based TOTP with encrypted secret storage, hashed single-use recovery codes, and a login flow that requires the second factor before setting the auth cookie.
• Login activity visibility and privacy controls: a dashboard widget summarizing successful logins, failed attempts, and rate-limit lockouts over the past week, with anonymised IP storage, auto-pruning, and removal on uninstall.