About this plugin
Protect WordPress login and wp-admin with IP allowlisting, custom login URLs, email OTP, rate limiting, CAPTCHA, logging and alerts.
Features
- Allow exact IPv4/IPv6 addresses and CIDR ranges.
- Accept IPv4 shorthand such as 171.61, stored as 171.61.0.0/16.
- Change the WordPress login URL.
- Protect the normal wp-login.php endpoint.
- Optional IP blocking for the login and wp-admin pages, while keeping admin-ajax.php available.
- Return a 404 response for logged-out visitors who request the default wp-admin URL.
- Optional Cloudflare CF-Connecting-IP detection.
- Optional trusted X-Forwarded-For detection for known reverse-proxy setups.
- Optional localhost/loopback bypass for local development.
- Brute-force rate limiting and temporary lockouts.
- Email OTP verification for administrators, delivered to each administrator’s WordPress profile email address.
- Administrator-configured emergency fallback code for environments where email cannot be delivered.
- Optional Google reCAPTCHA v2, reCAPTCHA v3 or hCaptcha on the WordPress login form.
- Security event logging with an administrator viewer and configurable retention.
- Optional email and Slack alerts for repeated blocked-IP or brute-force events.
Important
IP blocking is optional. When it is disabled, the custom login URL remains active but the allowlist is not enforced. Keep at least one known administrator IP in the allowlist before enabling IP blocking.
Only enable Cloudflare IP detection when the site is actually behind Cloudflare. Only enable trusted X-Forwarded-For when the server is behind a trusted reverse proxy that sets that header.
1 or::1 rather than the browser’s public VPN address. Use a publicly reachable staging site for an end-to-end VPN IP test.
The emergency fallback code is stored as a password hash and is never displayed after saving.
External Services
This plugin can optionally communicate with third-party CAPTCHA verification services when CAPTCHA is enabled:
- Google reCAPTCHA: the login page loads Google reCAPTCHA assets and sends the submitted CAPTCHA token to Google’s verification endpoint. See https://policies.google.com/privacy and https://policies.google.com/terms.
- hCaptcha: the login page loads hCaptcha assets and sends the submitted CAPTCHA token to hCaptcha’s verification endpoint. See https://www.hcaptcha.com/privacy and https://www.hcaptcha.com/terms.
The plugin does not contact these services when CAPTCHA is disabled.
IP access examples
220
61
0/16
Email OTP
After a successful WordPress administrator password check, a six-digit OTP is generated and sent to that administrator’s WordPress profile email address.
If email delivery is unavailable, an administrator-configured emergency fallback code can be used.