About this plugin
de.
Included in this edition
Everything below is part of this download and stays free. Nothing here is a trial, and nothing switches itself off.
- Login using your Vereinsflieger.de account
- No extra registration for your members needed
- Works with enabled 2 factor authentication
- Keeps your wordpress account up to date (name, email, …)
- Prevents disabled users from Vereinsflieger.de to login
- Protects the Vereinsflieger API quota with IP-based rate limiting: configure the threshold, the lockout duration and whether it covers every WordPress login, and unblock addresses again from the Security page
- Shows how much of the daily Vereinsflieger request quota is left
- Supports local custom translations that are not overwritten by WordPress.org language packs
de support. de account.
What Fliegerlogin Premium adds
The free edition blocks a single address that guesses passwords. That covers the everyday case and it is the case most clubs ever see.
It does not cover an attack spread across hundreds of addresses, where no single one reaches the threshold. A club in that situation needs to look at the traffic as a whole rather than at one visitor at a time, and it needs a record of what happened. Fliegerlogin Premium is a separate download that adds:
- A protection overview with a status badge for every safeguard, active failure counters and the most recent rate limit events, all on one page
- A circuit breaker that pauses all Vereinsflieger calls when the overall traffic spikes or the daily quota runs out — distributed attacks from many addresses never reach a per-address limit
- Geo blocking by country, with detection via Cloudflare, web server variables, the PHP geoip extension or a MaxMind database, plus automatic GeoLite2 database updates
- A negative cache so repeated wrong credentials fail instantly instead of spending API requests
- Guards that skip the Vereinsflieger lookup entirely for XML-RPC requests, for implausible usernames and for attempts a captcha plugin has already rejected — Cloudflare Turnstile is recognised without configuration, any other captcha plugin by naming the error code it sets
- Username enumeration protection for?author=N, author archives, the REST users endpoint and the author sitemap, plus uniform login error messages
- A debug log covering the whole authentication flow, with viewer, filters and automatic redaction of passwords and tokens
Premium is licensed under the GPLv3 as well: pricing and purchase. Questions about it are welcome in the support forum on this page.
de was not involved in the development, neither ordered the development of this plugin.
External Services
This plugin connects to one external service.
de — the whole point of the plugin. de/interface/rest/ to verify the credentials and read the member’s name, email address and status. Nothing is transmitted unless someone attempts to log in.
de/datenschutz/
This edition contacts nothing else. ch about its licence key: once a day and whenever you press the button, it sends the key and this site’s domain and receives a signed answer. No member data is involved, and this free edition contains none of that code.
Credits and License
Fliegerlogin is free software licensed under the GNU General Public License version 3 or later. The full license text is included in the LICENSE file.
de)
Copyright (C) 2025-2026 Simon Kuhn
2 in May 2022. It has been maintained and substantially extended by Simon Kuhn since 2025; every change is documented in the changelog below.