Before anything else

This plugin can, in principle, stop somebody signing in — that is its whole job — so the first thing to know is why it will not be you.

Four things stop it, and they overlap on purpose:

• a signed-in administrator is never locked out. Whatever the rest of the settings say, if you are already signed in somewhere, you are not affected;
• the address you switched the plugin on from is trusted automatically. It is put on the trusted list during activation, before anything else runs;
• there is a recovery link that works from anywhere. It is on the The sign-in page screen. Copy it somewhere that is not this website;
• WP-CLI can undo anything. wp login-security unlock <address>, wp login-security trust <address>, wp login-security door.

The first screen of the plugin shows you which address you are on right now and whether it is trusted, with a button to add it if it is not.