One tap on the phone the person already holds. A key that never leaves the device. The same idea across WordPress, Linux, Windows and Active Directory.
Typed into the wrong window, reused across sites, stored where the site can read them. One leak is enough.
A convincing login page harvests the secret — and a second factor typed into the same page goes with it.
“Someone logged in as admin” is usually all the audit trail says. Which device, which person, approved how?
admin · 192.0.2.10 · 41 s left
Approve DenyThe site mints a one-time request: id, nonce, origin, 120-second life.
The QR — or a tap on the same phone — hands the request to the app.
The app shows the site and account; the phone’s lock authorises the signature.
The server checks the signature against the enrolled public key and the origin.
The browser that started the request gets the session; the request is consumed.
Only the browser that created the request can collect the session, so an approval can’t be planted in someone else’s browser.
TEE · StrongBox · TPM · software, shown honestly per device.
Signature covers site, request, nonce and time.
Rate limits on every unauthenticated endpoint.
One device, one account, instantly, from the profile page.
Password form and QR side by side. Whichever the visitor reaches for first works. Default for a soft rollout.
A stolen password alone is not enough; the phone confirms. The QR is not offered before the password step.
No password form for accounts with a device. Accounts without one still get the password fallback.
The Windows sign-in screen offers the Thessley tile; the password tile is hidden and re-asserted by policy. Domain accounts keep working.
NLA off so the connection lands on the tile, always prompt, and only Administrators may connect at all.
SSH is administrator-only and every login needs the key plus the phone. Logon rights are written and verified, not just suggested.
The domain controller keeps the central registry: pair a PC once, and its users sign in with the phone that already holds their key.
Public feeds + local escalations
Country allow/block
wp-login by country
Per-IP throttling
SQLi, XSS, traversal
Failed-login lockout
Core + baseline
Webshell signatures
Outdated components
Flagged-only mode
Hidden admins
Post-compromise tools
Browser-side
Telegram + email
Everything, severity 1–20
Audit + crawler log
The Windows installer detects a paired PC, installs the tile, hides the password provider, gates SSH, sets RDP and logon rights — and can keep every change instead of timing out.
Every hardening step saves its previous state and can arm a timed rollback; the installer passes -Keep only when you mean it.
Behavioural suites, HTTP end-to-end, real EC signatures, and Plugin Check in CI-shaped runs. Compatibility: WordPress 6.0+, PHP 8.3.
No external service, no telemetry, no phone-home. QR codes are generated locally; keys and audit data stay on your infrastructure.
The same key on the phone signs in to WordPress, Linux, Windows and the domain. One approval, one audit trail, nothing reusable left behind.