Nahnu Login Shield: Changelog

Improved

• Put your own username on the honeypot list. Usernames are public (author pages, feeds, the REST API), so bots try them. Add yours to the honeypot list and sign in with your email address instead. Anyone who tries the username gets locked out like a bot. Real email addresses are never blocked, so you can always get in. The Lockout tab shows which entries on the list are real accounts, and reminds you if one of them is yours.

Login protection

• Brute-force lockout with escalating lockout times, per-IP and per-username.
• Honeypot usernames: anyone who tries admin (or names you choose) is blocked instantly.
• CAPTCHA on login, registration and lost-password forms, with your choice of OOPSpam, Google reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile (managed or invisible) or Friendly Captcha.
• A JavaScript check that stops simple bots before they reach the login.
• Custom login URL that hides wp-login.php.
• IP allow list and block list, plus an emergency bypass constant (NAHNLS_BYPASS_IP) for wp-config.php.
• Optional early blocking: a one-click must-use plugin that turns away locked-out IPs before WordPress loads.

Two-factor authentication

• Authenticator app (scan a QR code), email code or passkey, and users can combine methods.
• Backup codes for every method.
• Enforce mode: require 2FA for chosen roles.
• Wrong codes are limited; a 2FA attempt is cancelled after 5 wrong codes and expires after 30 minutes.

Passwordless sign-in

• Passkeys: sign in with Face ID, Touch ID, Windows Hello, your phone or a security key.
• Magic links: sign in with a single-use link sent by email.
• Both respect lockouts, geo-blocking and 2FA.

WooCommerce

• Protection for My Account login, registration, lost password, checkout and order tracking.
• A “Login & security” tab in My Account, where customers manage passkeys, 2FA and sign-in options without seeing wp-admin.
• Customers complete 2FA on the My Account page, styled by your theme.

• Please sign in to manage your login and security settings.

  shortcode to show the same panel on any page.

Access control

• Disable XML-RPC.
• Restrict roles to specific IP addresses or ranges (IPv4 and IPv6).
• Login and logout redirects by role.
• Signup email verification: new accounts are held until the email is confirmed.
• REST API protection, including blocking username enumeration.
• Idle-session timeout with a warning, and force-logout of all sessions.

Geo-blocking and edge firewall

• Block or allow countries using Cloudflare, Bunny.net and other CDN headers, with a free IP-lookup fallback.
• Push blocks to the Bunny.net or Cloudflare firewall automatically, with automatic expiry.

Insight

• Event log with search, filters, date range and CSV export.
• Analytics: daily chart, top IPs and usernames, event breakdown.
• “When attacks happen” heatmap by weekday and hour.
• Security Checklist with 24 checks, a score and one-click fixes.
• Email alerts for logins, lockouts and new countries, plus a weekly digest.
• Optional dashboard widget.

Form integrations

• Bricks Builder forms, SureForms and WordPress comments.

For developers

• Template tags, shortcodes, actions and filters, REST routes and a JavaScript API for passkeys, magic links, 2FA and CAPTCHA.
• Run 2FA inside pop-up or slide-out login forms without a page reload.
• CAPTCHA widgets that work in forms built by JavaScript.

Design and languages

• The Login & security panel and the 2FA screen support dark mode, right-to-left languages and your theme’s colours.
• Fully translatable, and follows the WPML and Polylang language on the front end.

Privacy

• No tracking, and nothing is sent to us.
• No scripts are loaded from CDNs; external services are only contacted when you turn them on.
• Uninstalling removes all of the plugin’s data.