The log

Every attempt: when, from which address, which username was typed, and what happened — signed in, wrong password, turned away, locked out. Password resets are in it too, with a Password resets tab of their own that shows the reset emails let through and the requests refused, and so are the sign-ups the screening turned away, under Sign-ups.

• Search by address or username;
• Filter by what happened;
• Let one address back in from the row, without touching the settings;
• Let everybody back in with one button, for the afternoon somebody rings up locked out and you cannot be sure which address they are on. Both are buttons that post: opened in a new tab, with the middle mouse button or from a link saved from an earlier version, they let nobody in and the screen asks again, with the button to press;
• Download as a spreadsheet what you are looking at, every page of it: the tab you are on and anything you searched for, for your host or a security report. A username a machine typed to look like a spreadsheet formula is written as plain text, so opening the file never runs it;
• Empty the log, which deletes every row and cannot be undone, so it asks first and empties only on an OK. Opened in a new tab, with the middle mouse button or from a link saved earlier, it deletes nothing and the screen asks again.

Successes are recorded too, unless you switch that off. Was that me? is the question somebody asks the morning after, and a log of only the failures cannot answer it.

Rows older than the retention setting are deleted once a day. Thirty days by default.

Ten or more lockouts in the last day put a notice on the other wp-admin screens: Somebody is working on this site's sign-in page, with the number. The number comes from the log. It is counted again at most every five minutes, and at once after a new lockout, so a busy site's admin pages are not slowed down by counting. Not now hides the notice for a week. With Record every attempt off there is nothing to count, and the notice does not appear.

If the log's table goes missing, as it can after a restore that brought the database back without it, lockouts are still counted, the Dashboard says the table is not there, and the next page opened in wp-admin makes it again.