Stop Brute-Force Attacks Cold
Simple, effective login protection for WordPress. Progressive delays, custom login URL, and trend analytics make brute-force attacks impractical — and it works right out of the box.
How It Works
Failed logins get delayed. Successful logins stay instant. It's that simple.
Features
Practical tools to keep your WordPress login safe, with nothing extra getting in the way.
Security Setup Wizard
Pick a Conservative, Balanced, or Aggressive protection profile from the settings page and apply a full set of tuned defaults in one click.
Login Delay
Add a configurable delay after failed login attempts. Choose between fixed or random delays to slow down automated attacks.
Progressive Throttling
Delays grow with each consecutive failure. The first attempt gets a small delay; subsequent ones take progressively longer.
IP Lockout
Automatically lock out IP addresses after too many failed attempts. The lockout duration grows with repeated offenses.
IP Whitelist
Exempt trusted IP addresses from delays and lockouts. Useful for office IPs, VPNs, and development environments.
Email Alerts
Get notified when IP addresses get locked out, so you know when someone is trying to break in.
Failed Login Log
Track all failed login attempts with IP address, username, and timestamp. Filter by source, IP, or date range and export results as CSV.
XML-RPC & API Protection
Protect XML-RPC, REST API, and application-password authentication against brute-force attacks.
Password Reset Protection
Apply the same delays, lockouts, and logging to password reset submissions — without revealing whether an account exists.
Custom Login URL
Move your login page from /wp-login.php to a custom URL slug. Login, logout, lost password, and password reset all route through the custom URL.
Trend Analytics
7-day trends panel with daily totals, top attacking IPs, and most targeted usernames. See patterns at a glance from your dashboard.
Distributed Attack Detection
Spots credential-stuffing botnets when many IPs target one username — the pattern per-IP lockout can’t see. Alert-only, so real users are never blocked.
fail2ban Logging
Write failed-login and lockout events to a fail2ban-compatible log so offending IPs get banned at the network level. Download a matching filter and jail config in one click.
Proxy & CDN Awareness
Reads the real visitor IP behind Cloudflare, Sucuri, and nginx — validating CF-Connecting-IP against Cloudflare’s ranges so it can’t be spoofed. A health check warns on risky proxy setups.
Emergency Recovery URL
An opt-in secret URL that clears your own IP lockout when you have no admin or server access. Stores only a token hash, requires a confirm click, is rate-limited, and is fully audited.
Country Blocking
Optionally reject logins from chosen ISO country codes. A developer-integration feature: ships no GeoIP database and stays off until you hook a country resolver.
18 Languages
Translated into 18 languages including English, Spanish, French, German, and more. Ready for international sites.
2FA Health Check
The settings page checks for an active two-factor authentication plugin and tells you which one is installed, or recommends adding one if none is found.
Object Cache Notice
On sites without a persistent object cache, the settings page flags the potential database load from transient reads so you can make an informed choice about adding Redis or Memcached.
Why It Matters
Brute-force attacks are the #1 threat to WordPress sites. Automated bots can attempt thousands of password combinations per minute against an unprotected login page.
A simple 5-second delay reduces attack throughput from 1,000+ attempts per minute to just 12. Add progressive throttling and IP lockout on top, and Login Delay Shield makes brute-force attacks impractical. Legitimate users never notice a thing.