What this WordPress login security plugin turns on first
The first layer needs no setup. Five failed sign-ins from one address in 15 minutes lock that address out for 15 minutes, and 20 lock it out for 24 hours. A separate counter watches each account, so an attack spread across many addresses still runs into a wall.
The full rules, including how made-up usernames such as admin are handled, are on the WordPress brute force protection page.
On by default.
A custom login URL: less noise, not a lock
You can move wp-login.php to an address of your choosing. Visitors who aren't signed in can no longer reach wp-admin, and anyone who asks for the old address gets a 404 or your home page, whichever you pick.
Be clear about what this buys you. Moving the login page cuts the automated noise that hits the default address, which keeps your logs readable. It is not protection on its own: a hidden address can still be found or leaked, so the lockout and the checks below are what actually stop an attacker.
Off by default.
Protect wp-admin with a login gate and role rules
The login gate puts an HTTP authentication prompt in front of the login page, so a bot has to get past a second username and password before it can try a WordPress one.
Role restrictions decide who gets near the dashboard at all:
- block chosen roles, such as subscribers or customers, from the dashboard;
- limit chosen roles to IP addresses you allow, so an editor account only works from the office.
Both off by default.
WordPress password security: leaked and weak passwords
The leaked-password check refuses passwords that have turned up in public breaches. It asks the Pwned Passwords service using k-anonymity: only the first 5 characters of the password's SHA-1 hash leave your site, and the replies are padded. If the service can't be reached, the password is allowed rather than blocking the user.
Strong-password rules ask for at least 12 characters, 3 of the 4 character classes, nothing built from the username or email, and nothing from a common-password list.
Both off by default. Each is an item in Recommended settings, where it is ticked, so applying Recommended turns them on.
Unusual admin sign-ins and two-factor codes
When an administrator signs in from a network that account has never used, WP SecureGate logs it and emails you once if you have switched alerts on. A new device or an unusual hour adds to a sign-in risk score once an account has 5 sign-ins behind it. Blocking high-risk sign-ins is a separate choice, and it never blocks administrators.
For a second factor, require authenticator-app codes for the roles that matter. See the WordPress 2FA plugin page for how set-up works.
Detection is on by default. Blocking high-risk sign-ins is off, and 2FA is required for no role until you choose one.
Secure WordPress login without locking yourself out
Every lock on this page can be lifted by the owner, in more than one way:
- a single-use emergency link, emailed only to administrator addresses, at most once an hour and 3 times a day;
- 8 one-time recovery codes you generate in advance and keep somewhere safe;
- the WP-CLI commands wp securegate recover and wp securegate recovery-codes;
- the WPSG_SAFE_MODE constant in wp-config.php, which lifts the login URL, login gate, role and IP rules, ownership lock, lockout and 2FA.
Always available. Recovery codes work only once you have generated them.
The ownership lock
On sites with several administrators, you can lock the plugin to named owners. Other admins, or a hijacked admin account, then can't deactivate it, delete it or even see it. It also disappears from the REST plugin list, the Updates screen, Site Health and the auto-update email.
It works inside WordPress only. Someone with FTP, SSH or WP-CLI access can still remove the plugin, so keep those credentials tight as well. Safe mode doesn't switch the firewall off, either; that takes a separate constant, WPSG_FIREWALL_OFF.
Off by default. Once enabled, hiding the plugin is on too.
Part of WP SecureGate: Brute-force protection →