Search plugins, docs and guides… Buy · from $19/yr Buy

Sell more

Protect and comply

Speed and delivery

Content and SEO

Launch and support

All 15 plugins Every plugin from $19 a year, or pay once from $49. Pricing Not sure which one? Search plugins, docs and answers

Login Security documentation

Setting it up, and how each part works: 22 sections, free to read before you buy.

  1. Before anything elseThis plugin can, in principle, stop somebody signing in — that is its whole job — so the first thing to know is why it will not be you.
  2. Getting startedActivate it.
  3. How the lockout worksFailures from one address are counted inside a window — fifteen minutes by default.
  4. Password reset requestsThe lost-password form sends a real email to a real account every time somebody asks, and anybody can ask.
  5. Sign-upsA shop that lets customers register, or a membership site, fills up with accounts nobody will ever use.
  6. Refused before the password is checkedA password hash is slow to compute on purpose — that is what makes a stolen database hard to use.
  7. Usernames nobody on your site hasadmin, administrator, root, test, user, guest, webmaster, support, demo, wordpress, wp-admin, sysadmin.
  8. A second step at sign-inSix digits from an authenticator app, after the password.
  9. Refusing a weak passwordOff by default, on the Settings screen under The password itself.
  10. Usernames nobody can look upA sign-in is two halves, and on a stock WordPress site the username is the easy one: the site hands it to anybody who asks.
  11. Not telling a machine which half was wrongWordPress says Unknown username for one and The password you entered for the username X is incorrect for the other.
  12. Trusted addressesAddresses on this list are never locked out.
  13. The way back inThe trusted list covers the office.
  14. Moving the sign-in pageOff by default, and the screen is honest about what it is.
  15. XML-RPCxmlrpc.php has one call — system.multicall — that lets a single HTTP request carry hundreds of password attempts.
  16. The logEvery attempt: when, from which address, which username was typed, and what happened — signed in, wrong password, turned away, locked out.
  17. What it does not doSaid plainly, because a security plugin that is vague about its limits is worse than none: it does not make a weak password strong on its own. It can refuse a new one, and judge…
  18. PrivacyThe plugin records IP addresses, which are personal data in the UK, the EU and plenty of other places.
  19. From the command linewp login-security status # what is on, and what is happening wp login-security unlock 203.0.113.10 # let one address back in wp login-security unlock…
  20. Settings you can carry between sitesThe Settings screen exports what you have set up, and imports it on another site.
  21. Multisite networksNetwork-activate it and every site gets its own settings, its own log and its own trusted list.
  22. UninstallingDeactivating leaves everything alone: your settings, your log, your trusted list.

Still stuck? Ask the developers who wrote it. We aim to reply within one business day.