Login Guard Plugin for WordPress
Locks an address out after repeated failed sign-ins, with an admin log and a one-click unlock.
It keeps a readable log of recent lockouts and shows which addresses are locked right now, each with an Unlock button. Counters and lockouts are stored as expiring transients and the keys are hashed with your site salts, so a database dump does not hand over a list of visitor addresses, and nothing accumulates after an attack stops.
The address comes from REMOTE_ADDR only. Forwarded headers are ignored on purpose: trusting X-Forwarded-For without knowing the proxy in front lets an attacker rotate their key on every request and dodge the lockout entirely.
Preview
1 / 3
What's included
- Configurable failure limit, counting window and lockout length
- Repeat offenders get double the lockout, capped at 24 hours
- Correct passwords are refused while an address is locked - proven on the bench
- Allow list by exact address or by range prefix, for your office or VPN
- Readable log of the last 100 lockouts plus an Unlock button per address
- Optional email to the site administrator when an address is locked
- Counters are expiring transients: nothing grows forever, and uninstall removes every key
- No external service, no firewall rules and no claim of legal compliance
At a glance
| Platform | WordPress plugin |
|---|---|
| Latest version | v1.0.2 |
| Download size | 17.9 KB |
| Released | 25 Oct 2026 |
| Downloads | 0 |
| Access | Free — sign in to download |
| Platform | WordPress 6.2 or newer (tested on 7.1.3) |
| PHP | 7.4 or newer (tested on 8.4) |
| Files | 6 - bootstrap, two classes, readme, licence, uninstall |
| Database | two option rows plus expiring transients, all removed on uninstall |
| Settings | Settings > Login Guard |
| Licence | GPL-2.0-or-later |
Requirements
- WordPress 6.2 or newer (tested on 7.1.3)
- PHP 7.4 or newer (tested on 8.4)
- A web server that passes the real visitor address to PHP (not a proxy that hides it)
- No external service and no account
Checksum
Verify your download before you upload it to your board.
76007bd2403b58083ba728784b65cfe14f8ebd05db274a1ea3a06cf15da68cbcInstall it
2. Open Settings > DF Login Guard and set the failure limit, the window and the lockout length.
3. Put your own office or VPN address in "Never lock" before you go live, if you would rather not risk a lockout.
4. Watch "Addresses locked right now" - each row has an Unlock button that clears the counter, the lockout and the escalation strike.
Questions people ask
Will I lock myself out?
Only if you fail the sign-in five times in fifteen minutes from the same address. The lock expires by itself, and the allow list ("Never lock") prevents it entirely for addresses you trust. Set that up before you go live.
Can I unlock someone immediately?
Yes. Settings > Login Guard lists every address in the log with an Unlock button; unlocking clears the counter, the lockout and the escalation strike for that address.
Does it work behind Cloudflare or another proxy?
It reads the address your web server sees. If your proxy passes its own address to PHP, every visitor looks the same, so on those hosts use the allow list for known addresses or leave the plugin off. This is stated plainly instead of guessing which header your host fills in.
Does it claim to make my site compliant with anything?
No. It is one narrow job - stop password guessing against the sign-in form from a single address - and it makes no legal or certification claim of any kind.
What happens when I delete the plugin?
uninstall.php removes the settings, the log and every counter, lockout and escalation transient it created.
All releases
| Version | Released | Size | Downloads | Changelog |
|---|---|---|---|---|
| v1.0.2 latest | 25 Oct 2026 | 17.9 KB | 0 | 1.0.2 - Re-verified on WordPress 7.1.3 with PHP 8.4: installed, activated and exercised on a clean bench (front end, settings screen, the plugin's own behaviour) with WP_DEBUG on. No notices, warnings, deprecations or errors. readme.txt now declares Tested up to 7.1.3. |
| v1.0.1 | 25 Oct 2026 | 18.5 KB | 1 | Removed the `Update URI` header. WordPress.org's automated scan reads that header as a third-party updater (plugin_updater_detected); updates are served by WordPress.org, so the header has no place in a hosted plugin. No change to how the plugin works. |
| v1.0.0 | 25 Oct 2026 | 17.9 KB | 3 | - First public release. |
Ratings & reviews
Ratings come from registered members only — that is the whole point.
Sign in to rateFree account, 20 seconds. Create one