Every layer of login security, in one place.
Turn on what you need. Each feature works on its own, so you can start with lockout alone and add more later. Every demo below is interactive.
Make guessing a losing game.
Attackers get a few tries, then a timeout that grows. Honeypot usernames end the game on the first guess.
- Escalating lockout. After a set number of short lockouts, an IP gets a long one (24 h by default).
- Per-username lockout. If one username is tried from many IPs, the username itself is locked everywhere.
- Honeypot usernames. “admin”, “root”, “test” and friends lock the IP and the name globally after one try.
- Allow and block lists. IPv4 and IPv6, with CIDR ranges, and a one-click unlock in the log.
Pick the CAPTCHA that fits your visitors.
Choose one provider site-wide and the widget appears on every protected form. Prefer none? Lockout, geo-blocking and honeypots still work.
- Fails open. If a provider’s API is down, real users are never locked out.
- JavaScript presence check. Headless bots are stopped before CAPTCHA runs, which saves your API quota.
- OOPSpam extras. Optionally block VPN or proxy traffic, datacenter IPs and disposable email addresses at login.
Stronger sign-in, with fewer passwords.
Let each person use any mix of methods, then require it for the roles that matter.
- Any combination. Authenticator app, email code and passkey. The challenge offers every method a user has set up.
- Remind or enforce, per role. Enforced users with nothing set up get a one-time email code and a nudge to add something stronger.
- Backup codes work as a fallback for every method.
- Customers never see wp-admin. WooCommerce users manage security and complete 2FA right inside My Account.
- Built-in passkey verifier. ES256, RS256 and Ed25519, with no external service. Requires HTTPS.
Close the doors you don’t use.
Small switches that remove whole classes of attack. A built-in checklist scores your setup and fixes the easy things in one click.
- XML-RPC kill switch. Returns 403 before WordPress loads.
- Custom login URL. Move wp-login.php, and choose a 404 or a redirect for the old address.
- REST API protection. Block user enumeration, apply lockout to REST auth, optionally disable Application Passwords.
- Restrict roles to IP ranges, and set login and logout redirects per role.
- Sessions. Idle timeout with a two-minute warning, and a one-button “log everyone out”.
- Signup email verification with automatic pruning of unconfirmed accounts.
Flip the switches to raise your score.
Block countries without slowing anyone down.
The visitor’s country is read from your CDN’s headers, so there’s no lookup delay and no API quota. Only if no header is present does it fall back to a free IP service, cached per IP.
- Choose countries to block, and whitelist the IPs that must always get through.
- Works alongside lockout, CAPTCHA and 2FA. Geo blocks are logged with the country.
- New-country alerts can email a user the first time they sign in from somewhere new.
CF-IPCountryCDN-CountryCloudFront-Viewer-CountryX-Vercel-IP-CountryX-Country-CodeX-Geo-CountryStop repeat offenders at the CDN, not at your server.
Push locked-out IPs to Bunny.net or Cloudflare with one setting. They’re blocked at the edge before a single request reaches you.
- Bunny.net WAF and Cloudflare IP Access Rules (not limited by the five-rule WAF cap).
- Choose the trigger: honeypot hits, brute-force lockouts, or both.
- Auto-expiry via WP-Cron, plus an edge-block log with IP, provider, reason, age and one-click unblock.
- Only the blocked IP address is sent to the provider, and pushes run in the background so attackers can’t slow you down.
| IP | Provider | Reason | Expires |
|---|
See exactly what’s knocking.
Every event is recorded in your own database, with the form or endpoint it came from. Nothing leaves your site.
- Search and filter by IP, username, event type or date range, and export to CSV.
- Source column shows WooCommerce My Account, REST API, XML-RPC, Bricks Builder and more.
- Analytics: 30-day activity chart, attack time-of-day heatmap, event breakdown, top IPs and top usernames.
- Weekly digest and login alerts by email, if you want them.
- You set the retention period and the row cap.
When attacks happen
Darker means more events. Hover a square.
The details that make it feel finished.
Early block
A must-use plugin turns locked-out IPs away before WordPress loads. It’s installed on activation and removed on deactivation.
WooCommerce My Account
Login, registration, lost password, checkout and order tracking, each with its own toggle, plus a Login & security tab for customers.
Login notifications
Email users on sign-in, alert admins when an administrator logs in, and get a weekly digest of failed attempts and top targets.
Developer API
Template tags, shortcodes, 20+ actions and filters, REST routes and a JavaScript API let you protect any custom form.
MainWP extension
A companion extension shows lockouts, edge blocks and recent events across all your connected sites.
30 languages
Translations ship with the plugin, so your team and customers see their own language.
Ready to close the front door?
Free, with every feature on this page. No license key and no upsell.
Install from WordPress.org