Login Security: questions and answers
Answers to the questions people ask: 31 of them, free to read before you buy.
- I am locked out of my own site. What now?Login Security gives you four ways back in, and none of them needs the admin screens.
- Will this lock me out?It tries quite hard not to.
- Does this actually stop anyone getting in?It stops guessing, which is the overwhelming majority of what arrives at a WordPress sign-in page.
- Which authenticator app should I use?Any of them.
- What if somebody loses their phone?They use one of the ten recovery codes they were shown when they set it up — that is what those are for.
- We used Wordfence (or Two Factor) for two-step sign-in. Does everybody have to set it up again?No.
- Can people skip the code on their own computer?Yes, if you allow it.
- Can my shop's customers use a second step?Yes, in My Account → Two-step sign-in, a tab after Account details.
- The Two-step sign-in tab opens a page that cannot be foundWordPress learns the tab's address on the next page you open in wp-admin after the tab is switched on, and again the same way after WooCommerce has been switched off and on…
- Why is there no text-message option?Because a text message is not a second factor worth having.
- Does the QR code go to Google?No.
- Can it tell me which of my users have weak passwords?Yes, once each of them has signed in.
- Will refusing weak passwords annoy my customers?It can, which is why Applies to exists.
- Does it stop fake sign-ups?Yes, on WordPress's own registration form and on WooCommerce's My Account form, with Settings → Sign-ups → Screen new sign-ups for bots.
- Why not just use a CAPTCHA?They are not exclusive, and a CAPTCHA solves a different problem.
- Will it slow my site down?The opposite, on a site the machines have found.
- Does it work behind Cloudflare, or a load balancer?Yes.
- Somebody is trying my real username. Should I worry?That is exactly what the first screen is for, and it is worth acting on.
- My users are getting password reset emails they never asked forThat is somebody, usually a machine, typing their usernames into the lost-password form.
- A customer who was locked out cannot get a password reset emailTheir address is locked out for guessing: somebody there typed the wrong password too many times.
- A customer was told to check their email, but no reset email cameFirst check that what they typed is really an account.
- How do I see who has not set up a second step?Users → All Users has a Second step column, and the No second step link above the list narrows it to the people who can change the site and have not set one up.
- I got an email about a lockout. Is my site hacked?Almost certainly not.
- Why only one email a day?Because a site the machines have found is locked out dozens of times a day, and forty emails in an afternoon teaches you to ignore the forty-first — and then the one that matters.
- Does moving the sign-in page make me safe?No, and the screen says so.
- My sign-in page is a 404 after moving itThe plugin catches the new address itself, before WordPress decides what the request is, so permalinks and rewrite rules are not involved and re-saving them changes nothing.
- Will it break Jetpack or the WordPress app?Not on the default setting.
- Does it store my visitors' data?It records the address, the username typed and the outcome of every sign-in attempt, and of every sign-up it turns away.
- My log is enormousThat is a site the machines have found, and it is normal.
- Does it work on multisite?Yes.
- Can I move my settings to another site?Yes — export on the Settings screen, import on the other site.
Nothing here matches that. Search everything
Still stuck? Ask the developers who wrote it. We aim to reply within one business day.