AphoniX is a lightweight, high-performance WordPress security plugin that protects your WordPress login page from brute force attacks, bot attempts, and unauthorized credential stuffing. AphoniX includes a generated CAPTCHA that runs locally, plus optional Google reCAPTCHA v3. Authenticator QR codes
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.0 and PHP 7.4.
SourceWordPress plugins · Nov 15, 2026
01 / Source details
Aboutthistool.
AphoniX is a lightweight, high-performance WordPress security plugin that protects your WordPress login page from brute force attacks, bot attempts, and unauthorized credential stuffing.
AphoniX includes a generated CAPTCHA that runs locally, plus optional Google reCAPTCHA v3. Authenticator QR codes are generated locally. Google verification contacts Google only when that provider is selected and CAPTCHA is enabled.
Main Features
Optional Google reCAPTCHA v3 : Choose background verification with your Google Site Key, Secret Key and score threshold. Generated CAPTCHA remains the default.
Inline Authenticator Setup : Scan and confirm the offline QR code directly in Login Protection or the setup wizard. Existing profile setup remains available.
Custom SVG CAPTCHA on Login : Adds an interference-resistant, bot-blocking SVG CAPTCHA challenge directly onto the login form.
Two-Factor Authentication (2FA) : Adds a secure second verification factor after successful password verification.
Google Authenticator & Authy Support : Supports standard TOTP authentication apps (Google Authenticator, Authy, Microsoft Authenticator) with local QR code generation in your browser.
Email One-Time Password (OTP) : Delivers 6-digit verification codes straight to verified user emails.
Local CAPTCHA & QR Codes : Generated CAPTCHA and authenticator QR codes work locally. Optional Google reCAPTCHA v3 loads Google scripts and sends tokens to Google. Email OTP messages use your configured WordPress mail provider.
Third-party source and license
QRCode.js by davidshimjs, including QR Code for JavaScript by Kazuhiko Arase, is distributed under the MIT license. Source: https://github.com/davidshimjs/qrcodejs The readable source and MIT license are included in assets/js/qrcode.js and assets/js/qrcode-LICENSE.txt. No build step is required.
External services
Google reCAPTCHA v3 is optional and off by default. When selected and CAPTCHA is enabled, protected WordPress login forms load Google’s reCAPTCHA script. The server sends a token and your Google CAPTCHA secret to Google’s SiteVerify API to verify the score, action, hostname and age. Google can receive visitor browser/network data. Generated AphoniX CAPTCHA does not contact Google. Service: https://www.google.com/recaptcha/about/ Privacy: https://policies.google.com/privacy Terms: https://policies.google.com/terms
Privacy
Generated CAPTCHA and authenticator checks run locally. Authenticator QR codes are generated in the browser using the bundled library. Optional Google reCAPTCHA v3 loads https://www.google.com/recaptcha/api.js and sends verification tokens to https://www.google.com/recaptcha/api/siteverify. Google Site Key, Secret Key and threshold are saved in WordPress options. The saved Secret Key is not echoed into settings HTML. Google Privacy Policy: https://policies.google.com/privacy and Terms: https://policies.google.com/terms . Email OTP messages are sent using wp_mail() and your configured mail provider, which processes recipient addresses and message contents. Security logs store IP addresses, user IDs, timestamps and event details locally, with a maximum of 500 entries. Authenticator secrets and hashed recovery codes are stored in WordPress user metadata. Uninstall removes plugin settings and authentication metadata.
01Upload the aphonix folder to the /wp-content/plugins/ directory, or install the plugin directly through the WordPress Plugins dashboard.
02Activate AphoniX through the Plugins screen in WordPress.
03Navigate to AphoniX -> Login Protection to configure your security rules.
04If you enable the Hide Login URL feature, make sure to bookmark your new login URL before logging out.
03 / Source details
Frequently asked questions.
Does AphoniX transmit any user secrets to third-party services?
Authenticator secrets and QR codes are generated locally; QR generation does not use an external service. Generated CAPTCHA runs locally. If you select Google reCAPTCHA v3, protected login forms load Google scripts and the server sends tokens and the Google CAPTCHA secret to the Google verification API. Google can receive visitor browser/network data. Email OTP uses your configured WordPress mail provider.
What happens if my email server fails and I cannot receive the 2FA OTP?
AphoniX allows administrators to generate and download 8 Emergency One-Time Recovery Codes from the settings screen. Any of these codes can be entered on the 2FA prompt to gain access.
Can I enforce 2FA only for Administrators?
Yes. Under AphoniX -> Login Protection -> Role-Based 2FA Enforcement , you can select which roles require two-factor verification.
What should I do if I forget my custom Login URL slug?
If you lose access, connect to your server using SFTP, FTP, or your hosting file manager, and temporarily rename the /wp-content/plugins/aphonix/ folder. This deactivates the plugin so you can log in at /wp-login.php . Once logged in, rename the folder back to aphonix and update your settings.
Is IP blocking permanent?
No. AphoniX blocks IPs temporarily to mitigate active brute force and credential-stuffing attacks while preventing legitimate users from being locked out indefinitely.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
