About this plugin
DigitSummit Loginly takes care of the whole front door of your WordPress site: how it looks,
where it lives, what protects it, and how you get back in when something goes
wrong.
Everything is edited from one screen with a live preview. No Customizer, so it
works the same on classic and block themes.
Looks
- Logo, colours, background (solid, gradient or image), card, fields, button.
- Three layouts: centred, split screen with a visual panel, form to one side.
- Three ready-made templates — one per layout.
- A “Login” block for the editor: the same styling on any page.
- A built-in contrast check against WCAG 2.1 level AA, with a suggested fix when
a pair falls short.
A login address only you know
php
answer 404. This removes the automated background noise that hits every
WordPress site around the clock.
It will not lock you out. After you apply a new address, the server calls it
back like a logged-out visitor and checks that the form really appears — and
that the old address really stopped answering. If the check fails, the previous
setting is restored automatically. An hourly watch repeats that check: after
php comes back and you are emailed. On
php constant, and a
wp loginly unlock command.
Security that is honest about itself
An exposure report queries your own site from the server, without being logged
in, and tells you what a stranger actually gets: the account list through the
author=1 probe, the author sitemap. Most findings have a button
that closes them on the spot.
The report also states plainly what moving the login page does not do. It is
not a lock. The lock is:
- attempt slowdown, per IP address, with a growing delay;
- a decoy field that costs nothing and depends on no third party;
- neutral error messages, so nobody learns which accounts exist;
- two-step verification by authenticator app, with backup codes.
What you keep a trace of
An access log with anonymised IP addresses: who came in, from where, with what
outcome. Seven days by default — enough to understand what just happened — and
up to a year if an audit asks for it.
What Loginly Pro adds
Loginly Pro is a separate plugin. Nothing here is switched off waiting for a
payment: the code of these features is not in this plugin at all.
One styling published once and fetched by every site under the same licence —
the login address, the recovery key and the secrets of each site never travel.
Sign-in hours and approved addresses by role, a session length of your own,
passwords checked against known breaches when they are chosen — the password
never leaves your server, only five characters of its fingerprint do. An
anti-bot shield that asks nothing of your visitors and shows them to nobody:
the server sets a puzzle only solvable by trying, which a browser answers in a
fraction of a second and a password-guessing program has to answer on every
single attempt. An email the moment someone signs in from an origin never seen
on this site, a
weekly summary, every event forwarded to Slack or your own endpoint with a
signature, and the log exported as CSV for an audit. Passkeys (Face ID, Touch
ID, Windows Hello, security keys), sign-in links sent by email, nine more
templates, redirects by role or by user, the same styling on
the WooCommerce “My account” page and in the authentication emails, passkeys and
one-time sign-in links, leaked-password checking, sign-in hours and approved
addresses by role, carrying a configuration from one site to the next, temporary
access links, connected-device limits, network-wide styling for multisite, and
admin white labelling.
Does it call anyone?
No analytics, no telemetry, no phone-home. Two-step verification runs entirely
on your own server. The full list of what can be contacted, and when, is in the
“External services” section below.
Source code and build
The admin interface is written in JSX and bundled with esbuild. Both the sources
and the bundle ship inside the plugin: assets/admin/ and assets/block/ hold
the readable source, build/ holds what WordPress loads.
To rebuild it from the sources shipped here:
npm install && npm run build
mjs at the plugin root — a hundred lines, one
esbuild call, no code generation. jsx and
jsx and minifies the result, which is what build/
contains. Nothing in build/ comes from anywhere else, and rebuilding from the
sources shipped here reproduces it.
Bundled third-party resources: Inter and JetBrains Mono (Latin subset, variable
1 — full text in
txt. They are served from your own site: no request ever
leaves the browser to fetch them.
External services
Loginly makes no external request unless you enable a feature that needs one, or
until you press play on the introduction video. Here is exactly what is
contacted, and when:
- loginly.digitsummit.net (DiGit Summit, the plugin author) — the one-minute
introduction video on the plugin’s Home screen is served from this domain. The
poster image ships inside the plugin, so opening the screen contacts nobody:
the request happens only when you press play. That server then receives your
IP address and browser user agent. Nothing else is sent, and nothing is sent
on any other screen.
Terms —
Privacy
- Cloudflare Turnstile — only if you choose it as the anti-bot challenge.
com, and your
server sends the challenge token, your secret key and the visitor IP address
com/turnstile/v0/siteverify.
Terms —
Privacy
- hCaptcha — same, if you choose it instead. Script from js.hcaptcha.com,
com/siteverify.
Terms —
Privacy
That is the whole list for this plugin. It sends no analytics and no telemetry,
checks no licence server, and two-step verification runs entirely on your own
server. The anti-lockout check and the exposure report do make HTTP requests,
but only to your own site’s address, from your own server: no third party is
involved.