Saral Login Shield

Direct requests to /wp-login.php will return a 404 page (or redirect to a URL you specify). Your login form is only accessible at your custom slug.

Go to Users → Profile and scroll to Two-factor login . Install an authenticator app on your phone, add an account in the app by scanning the QR code shown (or typing the setup key), then enter the 6-digit code the app shows and click Update Profile . Save the 10 backup codes you are given. To require it for every administrator, tick Require two-factor login for administrators under Settings → Saral Login Shield .

Enter one of your backup codes instead of the 6-digit code. Each backup code works once. After logging in, set up two-factor login again on your new phone from your profile. If you have no backup codes left, another administrator can turn it off for you under Users → Edit user . If you are the only administrator, add define( 'SARALSHIELD_DISABLE_2FA', true ); to wp-config.php, log in, and remove the line once you have set it up again.

Yes, for login forms that use WordPress’s own login function, such as WooCommerce’s My Account page: after the password, the code prompt is shown before the login is completed. Login forms that check passwords in their own way, or that log in through AJAX without loading a new page, are not supported.

The codes depend on the time, so check that your phone’s clock is set automatically. A code that has just been used can’t be used again, so wait for the next one if you set up two-factor login a few seconds ago.

Go to yoursite.com/?login-recovery (or yoursite.com/your-folder/?login-recovery if WordPress is in a sub-folder) and enter the email address of an administrator account. The login URL is emailed to that address. If email isn’t working on your site, deactivate the plugin by renaming its folder over FTP; this restores /wp-login.php .

Wait for the lockout to end (20 minutes by default), or log in from another network, such as your phone’s mobile data, and unblock your IP address under Settings → Saral Login Shield → Login activity . Lockouts are per IP address, so other people can still log in. For IPv6, a lockout covers the visitor’s /64 network, which is usually one home or office connection.

Yes. Under Settings → Saral Login Shield → Visitor IP address , choose Cloudflare or your proxy’s header. Otherwise every visitor appears to come from the proxy’s IP address, and one lockout would block everyone. The settings page shows the IP address it currently reads, and warns you when it detects Cloudflare. Only choose a proxy option if your site really is behind that proxy, because otherwise visitors can fake the header.

Turn it off unless something on your site needs it. Jetpack and some publishing and mobile apps use XML-RPC; most sites don’t. The block editor and the REST API are not affected.

For each login, failed login, wrong two-factor code, lockout and recovery email: the time, the username entered, the IP address and the browser. For users with two-factor login, it stores their secret key (encrypted with your site’s security keys) and their backup codes (hashed like passwords). Records are deleted after 30 days (you can choose 7, 30, 90 or 365 days), and everything is removed when you delete the plugin. A suggested paragraph is added to Settings → Privacy for your privacy policy. The plugin doesn’t contact any outside service; emails are sent through your site’s normal email.

New installs get a random login URL such as /login-k3x9qa , shown in a notice after activation and on the Settings → Saral Login Shield page. You can change it there at any time. Sites updating from 1.0.0 keep the login URL they already have.

Each site has its own login URL and settings. Users are shared by every site of a network, so the login log and lockouts are shared too: an IP address locked out on one site is locked out on all of them. Only super admins see the login activity, and the main site’s setting decides how long records are kept. It has had less testing on multisite than on single sites, so try it on a staging copy first.

Yes. Saral Login Shield Pro is an add-on sold on saraltechies.com . It adds IP allow and block lists, bans for repeat offenders, CAPTCHA (including WooCommerce’s forms), two-factor login for any role with codes by email, “Was this you?” emails for new devices, a password policy with forced resets, session control, a security check, security alerts and reports. Everything in this plugin stays free and keeps working without it.