Zen Login & Authentication replaces the default wp-login.php experience with clean, accessible, theme-integrated forms that live on your actual site. It works out of the box on any WordPress theme and ships with first-class Elementor support: five drag-and-drop widgets that fit any page-builder layo
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.5 and PHP 8.0.
SourceWordPress plugins · Oct 27, 2026
01 / Source details
Aboutthistool.
Zen Login & Authentication replaces the default wp-login.php experience with clean, accessible, theme-integrated forms that live on your actual site. It works out of the box on any WordPress theme and ships with first-class Elementor support: five drag-and-drop widgets that fit any page-builder layout, with full Theme Builder compatibility.
The plugin works with no configuration and adds no tracking or “phone home” behaviour. Every feature that contacts an external service is opt-in — Google sign-in, breached-password checking (Have I Been Pwned), and Cloudflare Turnstile — so out of the box the plugin makes no external calls at all. See External services below.
What it does
Login with username, email, or either (configurable).
Registration with optional user-chosen passwords and auto-login.
Lost Password / Reset Password with the full WordPress email flow.
Account page — logged-in users edit their first/last name, public display name, email, and password from the frontend, without ever seeing wp-admin. Guests visiting the account page are sent to the login form and return after signing in.
Sign in with Google (optional) — a server-side OpenID Connect flow with no Google JavaScript on your pages. New accounts can be auto-created (toggleable) and existing accounts are linked by verified email.
Two-factor authentication (optional, opt-in per user) — app-based TOTP with local QR enrollment and one-time recovery codes, managed from the Account page. Once a user turns it on, a second-factor step is required at login.
Sign out of other devices — from the Account page, a logged-in user can end every other active session for their account in one click; the current device stays signed in.
Passkeys (WebAuthn) (optional, opt-in per user) — users add passkeys from the Account page and sign in with no password using Face ID, a fingerprint, Windows Hello, or a security key. Passwordless sign-ins are phishing-resistant and count as multi-factor, so they skip both the password and any two-factor step. Verified locally; requires HTTPS.
New-device login alerts — emails the account owner the first time their account is signed in from an unrecognised device or browser, using your site’s normal email. On by default.
URL rewriting so every site-wide wp-login.php link is transparently redirected to your frontend pages.
Multisite support — network-activated, per-site settings, signup/activation flow handled.
Smart redirects — ?redirect_to= is honoured everywhere. Subscribers are kept out of wp-admin and sent to a destination you set in Settings → Zen Login & Authentication → Subscriber redirect (a page slug or URL; empty = site home). That setting takes one destination per line — the first is the default, and the others are pages a subscriber may also be sent to when a link asks for one, so a site with several subscriber dashboards can route each person to the right one. Privileged users always land where they intended.
Login activity dashboard — a “Login Activity” widget on your WordPress dashboard summarising successful logins, failed attempts, and rate-limit lockouts over the past week, with the top failed usernames, the most-blocked IPs, and a recent-events feed. IP addresses are stored anonymised, history is auto-pruned, and the data is removed on uninstall.
Cache exclusion — auth pages are automatically excluded from LiteSpeed Cache, Super Page Cache, WP Rocket, W3 Total Cache, and WP Super Cache.
Security
Nonce verification on every form submission.
Rate limiting — configurable max attempts per IP with a lockout window, per form (login, register, lost-password, reset-password), with optional per-form thresholds.
Honeypot spam protection — rotating hidden field (hourly key rotation via HMAC) catches bots; trapped submissions get a fake success response.
Spoof-resistant IP detection — rate-limit keys use the real socket address ( REMOTE_ADDR ) by default; forwarded headers are opt-in via a filter for sites genuinely behind Cloudflare.
No password pre-population , bcrypt-compatible ( wp_set_password() / wp_signon() ), and an 8-character minimum on new passwords.
Username-enumeration hardening (on by default) — blocks ?author=N author scans and the REST /wp/v2/users listing for logged-out visitors, and collapses login errors to one neutral message so a valid username is never confirmed. A separate Hide empty author pages switch makes the author page and feeds of an account that has published nothing answer exactly like a name that doesn’t exist (WordPress otherwise uses them to confirm every login name, administrators included), and an Author URL profile field lets an author who publishes have a page address that doesn’t show their login. Everything for logged-in users is unaffected.
Breached-password blocking (optional) — reject passwords found in the Have I Been Pwned corpus at registration, reset, and account update, using k-anonymity: only the first 5 characters of the password’s SHA-1 hash are sent, never the password. Fails open if the service is unreachable.
Cloudflare Turnstile (optional) — a privacy-friendly bot challenge on the login, registration, and lost-password forms, on the plugin’s forms and wp-login.php alike.
XML-RPC lockdown (optional) — disable XML-RPC to close the system.multicall brute-force amplifier and pingback abuse.
Two-factor authentication (TOTP) — opt-in per user; the shared secret is stored encrypted, recovery codes are hashed and single-use, and the login challenge sets no auth cookie until the second factor verifies.
External services
This plugin contacts an external service only when you enable one of the optional features below. Out of the box it makes no external calls.
Google OAuth / OpenID Connect (accounts.google.com and oauth2.googleapis.com). When a user clicks “Continue with Google”, they are redirected to Google’s consent screen, and the plugin’s server then exchanges the one-time authorization code for an ID token. The data involved: the OAuth client credentials you configured, the single-use authorization code, and — returned by Google — the user’s verified email address, name, and Google account ID, which are used solely to log the user in or create their account on your site. This service is provided by Google LLC: Terms of Service , Privacy Policy .
Have I Been Pwned — Pwned Passwords (api.pwnedpasswords.com). Enabled only when “Block breached passwords” is turned on. When a user sets or changes a password (registration, password reset, or account update), the plugin sends the first 5 characters of the password’s SHA-1 hash to the range API and checks the returned list locally. The password itself, the full hash, and any user identity are never transmitted (k-anonymity model), and the request is cached. This service is provided by Have I Been Pwned: Terms of Use , Privacy Policy , Pwned Passwords .
Cloudflare Turnstile (challenges.cloudflare.com). Enabled only when Turnstile is configured. The challenge script is loaded on the protected forms, and on submission the resulting challenge token and the visitor’s IP address are sent to Cloudflare’s siteverify endpoint to confirm the visitor is not a bot. This service is provided by Cloudflare, Inc.: Terms of Service , Privacy Policy .
If none of these features are enabled (the default), the plugin makes no external calls whatsoever.
Elementor integration
Five native widgets registered under a “Zen Login & Authentication” category:
Login Form — custom labels, placeholders, toggle text, and link overrides; hidden when logged in (unless reauth=1 ); picks up ?redirect_to= from the URL.
Registration Form — password + confirm fields when user-chosen passwords are enabled, with a live strength meter.
Lost Password Form — password-recovery request form.
Reset Password Form — reads ?key=&login= from the URL and shows a friendly message when the link is missing or expired.
Account Form — frontend profile editing (first/last name, public display name, email, optional password change) for the logged-in user, with the same label/placeholder/style controls as the other widgets.
Every widget has a full style panel (container, title, labels, fields with focus glow, button normal/hover, links, messages, password toggle, strength meter).
Classic widgets
Five WP_Widget subclasses are also registered for classic / block-based widget areas: Login, Register, Lost Password, Reset Password, and Account.
Pages
On activation the plugin sets up a real WordPress page for each auth action so Elementor Theme Builder targeting works. For each default slug it reuses an existing page if one is there (never modifying or deleting it), otherwise creates one. The process is idempotent, so activate/deactivate cycles never duplicate pages, and the plugin also works with no real pages via its virtual URL-rewrite fallback.
See it in action
Screenshots & previews.
Settings — General: login identifier, pretty URLs, AJAX submission, user-chosen passwords, auto-login after registration, honeypot, and the subscriber redirect.Settings — Sign in with Google: enable the feature, add your Client ID and Secret (stored encrypted), choose whether new accounts are created automatically, and copy the authorized redirect URI for Google Cloud Console.Settings — Widgets: enable or disable each form widget (Login, Registration, Lost Password, Reset Password, Account) for the Elementor panel and classic widget areas.Settings — Rate Limiting: global max attempts and lockout window, plus per-form enable/disable and threshold overrides for Login, Registration, Lost Password, and Reset Password.Settings — Security Hardening: block username enumeration, show generic login errors, block breached passwords via Have I Been Pwned, and disable XML-RPC.Settings — Bot Protection (Cloudflare Turnstile): enable the challenge, add your Site Key and Secret Key, and choose which forms are protected.Settings — Two-Factor Authentication and Passkeys: master switch for TOTP (users enroll from the Account page) and passkey (WebAuthn) sign-in.Settings — New-Device Login Alerts and Login Activity: configure new-device email alerts with an optional custom body, and set the activity-log retention window.Settings — Page Slugs: customise the URL slug for each auth action (Login, Logout, Register, Lost Password, Reset Pass, Account).Settings — Tools: clear the activity log and manage auth pages (view status, create missing pages, or delete auto-created pages).Front end — Log In form on a live page: username or email and password (with a Show/Hide toggle), Remember Me, the Log In button, and Register / Lost-password links — then, below the "or" divider, the "Sign in with a passkey" and "Continue with Google" buttons.Front end — Registration form: username, email, and password plus confirm-password (each with a Show/Hide toggle), the Register button, a Log In link, and "Continue with Google" below the divider.Front end — Lost Password form: request a reset link by username or email address, with a Log In link back to sign-in.Front end — Reset Password form: choose and confirm a new password (with Show/Hide toggles) from the emailed reset link.Front end — Account page, Profile Information: update first and last name, email address, and public display name; the username is shown read-only. Save Profile applies the changes.Front end — Account page, Change Password: choose and confirm a new password (each field with a Show/Hide toggle); the current password is required to change the email address or password.Front end — Account page, Passkeys and Two-Factor Authentication: register or remove passkeys for password-free sign-in, and manage TOTP two-factor — recovery-code count, regenerate codes, and turning it off with a current code.Front end — Account page, Session Management: every device currently signed in (browser, IP, and date) with the current session marked, plus Log Out and Sign out of all other devices.Admin dashboard — Login Activity widget: successful, failed, and lockout counts for the last 7 days, top failed logins and top blocked IPs, and a recent sign-in feed.
02 / Source details
Gettingstarted.
01Upload the zen-login-authentication folder to /wp-content/plugins/ , or install it from Plugins → Add New .
02Activate the plugin through Plugins → Installed Plugins .
03Go to Zen Login & Authentication in the admin sidebar to configure options.
04Auth pages are created automatically on activation. If you delete some and want them back, use Create Missing Pages in the Page Management section.
05Rewrite rules flush automatically on the first page load after activation. If a frontend URL 404s, visit Settings → Permalinks and click Save Changes .
06(Elementor users) Open a page in the Elementor editor and search the widget panel under the Zen Login & Authentication category.
03 / Source details
Frequently asked questions.
Does it require Elementor?
No. The plugin works on any theme via its built-in forms and URL rewrites. Elementor only adds the optional drag-and-drop widgets.
Does it disable wp-login.php?
No. It rewrites the links across your site to your frontend pages, but wp-login.php remains available for administrators and recovery flows.
How do I let users choose their own password when registering?
Enable User-chosen passwords under Settings → Zen Login & Authentication → General . You can also enable Auto-login to log users in immediately after they register.
Where do users go after logging in?
?redirect_to= is always honoured. Subscribers (who can’t reach wp-admin) go to the Subscriber redirect you configure — a page slug or full URL, or the site home page if left empty.
I’m behind Cloudflare. How do I get the real visitor IP for rate limiting?
By default the plugin uses REMOTE_ADDR only, because forwarded headers are spoofable. If your origin firewall is locked to Cloudflare’s IP ranges, opt the header back in: add_filter( ‘zenlogau_rate_limit_ip_headers’, fn() => [ ‘HTTP_CF_CONNECTING_IP’, ‘REMOTE_ADDR’ ] );
How do I set up Sign in with Google?
In Google Cloud Console, create an OAuth client: APIs & Services → Credentials → Create credentials → OAuth client ID → Web application. Copy the Authorized redirect URI shown under Settings → Zen Login & Authentication → Sign in with Google, and add it to the OAuth client. Paste the Client ID and Client Secret into the same settings panel and switch the feature on. A “Continue with Google” button then appears on the login and registration forms (each Elementor widget has a toggle and style controls for it). The flow is entirely server-side — no Google JavaScript is loaded on your pages.
Can users edit their profile without going to wp-admin?
Yes. The Account page (created on activation, default slug /account/ ) lets a logged-in user change their display name, email address, and password from the frontend. Changing the password keeps the user’s current session logged in and signs out every other session, exactly like the wp-admin profile screen. Leave both password fields blank to keep the current password. Guests who open the page are redirected to the login form and brought back after signing in.
Is it multisite compatible?
Yes. It is network-activatable, with per-site settings and signup/activation handling.
What happens to my pages when I uninstall?
Only pages the plugin created that you never edited (no content, no Elementor data) are removed. Pages you edited, or pre-existing pages the plugin merely reused, are always kept.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
