AphoniX

AphoniX is a lightweight, high-performance WordPress security plugin that protects your WordPress login page from brute force attacks, bot attempts, and unauthorized credential stuffing.

AphoniX includes a generated CAPTCHA that runs locally, plus optional Google reCAPTCHA v3. Authenticator QR codes are generated locally. Google verification contacts Google only when that provider is selected and CAPTCHA is enabled.

Main Features

• Optional Google reCAPTCHA v3: Choose background verification with your Google Site Key, Secret Key and score threshold. Generated CAPTCHA remains the default.
• Inline Authenticator Setup: Scan and confirm the offline QR code directly in Login Protection or the setup wizard. Existing profile setup remains available.
• Custom SVG CAPTCHA on Login: Adds an interference-resistant, bot-blocking SVG CAPTCHA challenge directly onto the login form.
• Two-Factor Authentication (2FA): Adds a secure second verification factor after successful password verification.
• Google Authenticator & Authy Support: Supports standard TOTP authentication apps (Google Authenticator, Authy, Microsoft Authenticator) with local QR code generation in your browser.
• Email One-Time Password (OTP): Delivers 6-digit verification codes straight to verified user emails.
• Emergency Recovery Codes: Generates 8 one-time backup recovery codes to prevent administrator lockouts.
• Email Delivery Verification Test: Ensures your WordPress email/SMTP configuration delivers 2FA OTP codes properly before enforcing 2FA.
• Role-Based 2FA Enforcement: Selectively require 2FA only for sensitive user roles like Administrators and Editors.
• Login Attempt IP Blocking: Automatically blocks IP addresses after too many failed login, CAPTCHA, or 2FA attempts.
• Rapid Attempt Detection: Detects and throttles automated bot attacks submitting bursts of login requests.
• REST API User Enumeration Hardening: Stops unauthenticated hackers and bots from discovering author usernames via /wp-json/wp/v2/users.
• Hide Login URL: Customize your wp-login.php URL slug (e.g. /my-login/) and redirect direct attempts to a 404 or custom page.
• Security Activity Log: Records security events with timestamps, event types, IP addresses, and user IDs with one-click CSV export.
• Generic Login Error Messages: Prevents username enumeration by hiding detailed login failure notices.
• Local CAPTCHA & QR Codes: Generated CAPTCHA and authenticator QR codes work locally. Optional Google reCAPTCHA v3 loads Google scripts and sends tokens to Google. Email OTP messages use your configured WordPress mail provider.

Third-party source and license

QRCode.js by davidshimjs, including QR Code for JavaScript by Kazuhiko Arase, is distributed under the MIT license.
Source: https://github.com/davidshimjs/qrcodejs
The readable source and MIT license are included in assets/js/qrcode.js and assets/js/qrcode-LICENSE.txt. No build step is required.

External services

Google reCAPTCHA v3 is optional and off by default. When selected and CAPTCHA is enabled, protected WordPress login forms load Google’s reCAPTCHA script. The server sends a token and your Google CAPTCHA secret to Google’s SiteVerify API to verify the score, action, hostname and age. Google can receive visitor browser/network data. Generated AphoniX CAPTCHA does not contact Google.
Service: https://www.google.com/recaptcha/about/
Privacy: https://policies.google.com/privacy
Terms: https://policies.google.com/terms

Privacy

Generated CAPTCHA and authenticator checks run locally. Authenticator QR codes are generated in the browser using the bundled library. Optional Google reCAPTCHA v3 loads https://www.google.com/recaptcha/api.js and sends verification tokens to https://www.google.com/recaptcha/api/siteverify. Google Site Key, Secret Key and threshold are saved in WordPress options. The saved Secret Key is not echoed into settings HTML. Google Privacy Policy: https://policies.google.com/privacy and Terms: https://policies.google.com/terms . Email OTP messages are sent using wp_mail() and your configured mail provider, which processes recipient addresses and message contents.
Security logs store IP addresses, user IDs, timestamps and event details locally, with a maximum of 500 entries. Authenticator secrets and hashed recovery codes are stored in WordPress user metadata. Uninstall removes plugin settings and authentication metadata.