Phantom User Lockout

Bots guess usernames like “admin” and “administrator”. On most sites those names don’t exist, so any attempt with them is a bot. Phantom User Lockout records each one and blocks the IP address that made it.

For every attempt with a username that doesn’t exist on your site, you get:

• The time, in site time with UTC on hover
• The username and the password that was tried
• The IP address, shown as IP Blocked , Not blocked or Safe
• Where the IP is: city, region and country
• Who owns it: the hosting company or network (for example “AS53667 FranTech Solutions”) and the reverse hostname
• How the attempt came in: the login form, XML-RPC (every guess inside a system.multicall batch gets its own row), REST API application passwords, or another login form
• The user agent and the requested URL

Blocking

• An IP is blocked after its first attempt with a username that doesn’t exist. You can raise that threshold.
• Blocks are permanent. They only lift when you press Unblock .
• A blocked visitor gets a 403 page that reads “IP Blocked”.
• By default a block covers the login page, XML-RPC, REST logins and any other form that logs in through WordPress. You can widen it to the whole site.
• Optionally, the plugin can also block IPs that enter the wrong password for a real username. This is off by default, and the default threshold is 3 wrong passwords.

Built not to lock you out

• Real accounts are never recorded unless you turn on the real-account option, and even then their passwords are never stored.
• If a username is within two letters of a real login or email, it’s treated as a typo by one of your own people. It’s logged with the password hidden and never causes a block.