About this plugin
Lockspire is a focused, lightweight WordPress login security plugin. It stops brute-force attacks by locking out IPs that exceed your failed-login threshold, alerts you when it happens, and gives you a clear picture of your site’s security without unnecessary complexity.
What it does
Lockspire does a small number of things well, rather than doing many things poorly.
✅ Smart Login Protection
Automatically locks out IP addresses after too many failed login attempts. The lockout expires on its own – no manual intervention needed. The lockout threshold and duration are fully configurable.
✅ 🚨 One-Click Emergency Shield / Lockdown
Under active attack? Activate Emergency Lockdown with a single click to instantly tighten thresholds (2 attempts max, 60-minute lockdown) and defeat distributed bot attacks.
✅ 🍯 Bot Honeypot Auto-Ban
g. admin, root, administrator, test, system ) on their very first attempt, saving database resources and thwarting brute-force dictionaries.
✅ 🛡️ Username Enumeration Shield
author=1 ) and removing user lists from the WordPress REST API for unauthenticated visitors.
✅ 🔍 Threat Intelligence & Forensic Investigation
Integrated IP threat intelligence links (AbuseIPDB) directly in your activity logs and locked tables so you can investigate attacking IP reputations with one click.
✅ Trusted IP Allowlist
Add your own IP address (or CIDR range) to the allowlist so you are never accidentally locked out. Lockspire shows you your current IP on the management screen, and warns you if you are about to make a change that could affect your own access.
✅ Detailed Activity Log
Every failed and successful login attempt is logged to a dedicated database table with IP address, username, user-agent, and timestamp. Logs are filterable by event type and IP address, exportable to CSV, and automatically purged after a configurable retention period.
✅ Throttled Security Email Alerts
Receive an email when an IP is locked out. Alerts are automatically throttled (one per IP per configurable time window) so a sustained attack doesn’t fill your inbox. You can also receive optional alerts for successful logins.
✅ Security Health Check
php permissions, default “admin” username detection, honeypot auto-ban, user enumeration shielding, and trusted IP setup. Each check links directly to the right settings to fix any issues found.
✅ XML-RPC & Pingback Shield
Completely disables XML-RPC and removes X-Pingback headers, eliminating common attack surfaces for brute-force and DDoS amplification attacks. Safe to disable for most sites.
Who is Lockspire for?
- WordPress site owners who want reliable brute-force protection without installing a heavyweight all-in-one security suite
- Developers managing client sites who need a simple, trustworthy plugin they can configure once and leave running
- Anyone who has been locked out of their own site before and wants a lockout recovery path built in
What Lockspire does NOT do
Lockspire does not scan for malware, provide a web application firewall, or offer country blocking. These features belong in a different category of plugin. Lockspire focuses exclusively on login access protection and does it reliably.
Privacy
Lockspire logs IP addresses, usernames, and browser user-agents for login events. This data is stored in your WordPress database and is never transmitted to external servers. It is automatically purged after your configured retention period (default: 30 days).
We recommend documenting this in your site’s privacy policy.
Developer Information
Hooks available to developers:
lockspire_after_failed_login — Runs after a failed login attempt is recorded.
Parameters: $username (string), $ip (string), $attempt_count (int)
lockspire_after_lockout — Runs when an IP is locked out.
Parameters: $username (string), $ip (string)
lockspire_lockout_message — Filter the lockout message shown to the user.
Parameters: $message (string), $minutes (int), $seconds (int)
Option keys:
– lockspire_options — Main plugin settings array
– lockspire_trusted_ips — Allowlisted IPs and CIDR ranges
– lockspire_notification_emails — Additional alert recipient emails
– lockspire_email_logs — Sent email log (capped at 100)
Table: {prefix}lockspire_log — Login event log