FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login

You can let a role set up a second factor or require it, and you choose how strong a required one has to be: a device factor only, meaning a passkey or an authenticator app, or any of the three. Anyone who must have one sets it up while they sign in, before a session is created for them, so the requirement cannot be walked past.

An authenticator app also hands out ten single use recovery codes, and passkey users can fall back on those too. Everyone manages their own second factor from their WordPress profile screen, and an admin screen lists who has enrolled, what each person registered, and lets you reset anyone locked out.

Authenticator secrets can be encrypted in your database with a key you keep in wp-config.php, so reading the database gets an attacker nothing.

Passkey Login

Passkeys are the strongest option here. The credential lives on the device and is bound to your domain by the browser, so phishing does not work against it: a copied login page has a different domain and the passkey will not answer.

They can be the second step after a password, or the way in on their own – turn on passkey sign-in and the login form offers a button that signs the user in with no password at all. No third party service is involved: everything runs on your site.

Social Login and Registration

Let people sign in with the accounts they already have.

• Login with Google
• Login with GitHub
• Login with Facebook
• Google One Tap Login

Turn on the providers you want, paste the keys, and the buttons appear on your login and register forms. You can also stop social sign ups when registration is closed on your site.

Magic Login by Email

Users type their email address and get a one time login link. No password to remember and no reset flow to walk through. Make it the main way people sign in, or keep it as an extra option. Links are hashed, expire, are rate limited and can only be claimed once, and asking for a link never reveals whether an address has an account on your site.

Limit Login Attempts

Block brute force attacks by counting failed logins. Set how many attempts are allowed and over how many minutes, and FluentAuth locks the address out for a while. Every blocked attempt is logged, and you can be emailed when it happens.

IP Allow List and Block List

Two simple lists, one address or range per line. The block list refuses a login from those addresses outright. The allow list skips the attempt limit for addresses you trust, such as your office.

You can also require that a role only signs in from an allow listed address. FluentAuth detects reverse proxies and Cloudflare, so the address it acts on is the real visitor address and not your proxy.

Bot Protection with Cloudflare Turnstile

Stop spam signups before your site sends them an email. Turn on Cloudflare Turnstile for the signup forms, the login and password reset forms, or WooCommerce’s My Account forms. Each one has its own switch. If Fluent Forms or FluentCart already has Turnstile keys, you can use the same keys with one click. Checkout is never changed. If a site move ever leaves you locked out, adding define('FLUENT_AUTH_DISABLE_TURNSTILE', true); to wp-config.php switches it off.

Security Checklist

FluentAuth checks your site and gives you a short list of what to look at. Each item says what is wrong, why it matters and what happens if you fix it, and most have a button that fixes it for you. Anything that does not apply can be waved away, and you can take that back later. It checks things like:

• HTTPS, and PHP errors shown to visitors
• Theme and plugin file editing from the dashboard
• The security constants in wp-config.php
• Old backup files sitting in a public folder
• PHP execution inside your uploads folder
• Drop-in or mu-plugin files that have appeared or changed
• Administrators with an easily guessed username, or gone unused
• User accounts that do not show on the users screen

File Change Scanning

FluentAuth compares your files against the official copies published on WordPress.org.

• WordPress core files , against the official checksums for your version.
• Plugins from the WordPress.org directory , against the checksums for the version you have installed.
• Themes from the WordPress.org directory , against the official theme package, since themes have no published checksums. Needs the ZipArchive PHP extension, which most hosts have.
• Files nothing else can verify , such as a custom theme or a premium plugin, recorded in a snapshot so you hear about it when one changes.

When a file has changed you can see a side by side diff against the original, put the original back with one click, or delete a file that should not be there. You can also flag a plugin or theme running a version that was never published, a common sign that files were swapped out.

Activity and Audit Logs

FluentAuth records every login, failed attempt and blocked address, and every plugin or theme activated, deactivated or updated, with who did it. Logs go in their own database tables, so your WordPress tables stay clean, and old entries are cleared on a schedule you pick.

Email Notifications and Reports

Get an email when an administrator or editor signs in, or when someone is blocked for too many failed attempts. You can also get a daily, weekly or monthly summary of what happened on your site.

Recovery Tools

If you think somebody has been in your site, one screen tells you what to do next.

• Sign everyone out and revoke every application password
• Send password reset emails to your users, in batches so nothing times out
• Reinstall WordPress core from the official copy
• Reinstall a plugin or theme from the WordPress.org directory
• Rotate the security keys in wp-config.php, with a clear warning about what else that breaks

Everything done here is written to the audit log with the name of the person who did it.

Login Redirects

Send users to different pages after they log in or log out, based on their role. Set it up once and it applies to every login method, including social and magic login.

Login and Signup Page Customizer

Set your own logo, colours, background and form style on the WordPress login page, and see the result as you edit. You can also build login and registration forms anywhere on your site with shortcodes.

Custom WordPress System Emails

WordPress sends a lot of plain default emails. FluentAuth lets you rewrite them with your own wording and branding, and gives you one template design they all share. You can also turn off the admin notification that fires every time a new user signs up.

Core Security Hardening

Turn off the parts of WordPress your site does not use.

• Disable XML-RPC
• Disable application passwords and remote app login
• Stop user listings being read through the REST API
• Restrict /wp-admin for low level roles
• Hide the admin bar for the roles you choose

Remote Auth for Multiple Sites

Use one site as the login provider for your other sites. Users sign in once on the main site and land on the child site already logged in.

Guided Setup

A short setup wizard runs the first time you open FluentAuth. It asks a handful of questions, shows you what each answer changes, and turns on a sensible set of options. Skip it and nothing is written, and every answer is an ordinary setting you can change later.

Built to Be Fast

FluentAuth is one plugin doing the work of several, written to stay out of the way. The admin area is a single page Vue 3 app over the REST API, logs live in custom database tables, and no scanning agent sits in front of every request on your site.

For Developers

Another plugin can put its own login screen on FluentAuth’s flows. It registers with the LoginBridge service, and from then on its custom form gets the attempt limits, the IP rules and the two-factor challenge, including an inline second step on a custom AJAX action. There are filters through the whole auth flow, and the site owner’s settings always win over what an adopting plugin asks for.

External Services

Nothing below leaves your site unless you turn that feature on.

• File scanning compares your files against the official copies, so it fetches them from WordPress.org ( api.wordpress.org , downloads.wordpress.org , plugins.svn.wordpress.org , themes.svn.wordpress.org ) and the official WordPress mirror on GitHub ( raw.githubusercontent.com ). Only the name, version