Lockspire – Limit Login and Smart Access Protection

Lockspire is a focused, lightweight WordPress login security plugin. It stops brute-force attacks by locking out IPs that exceed your failed-login threshold, alerts you when it happens, and gives you a clear picture of your site’s security without unnecessary complexity.

What it does

Lockspire does a small number of things well, rather than doing many things poorly.

✅ Smart Login Protection

Automatically locks out IP addresses after too many failed login attempts. The lockout expires on its own – no manual intervention needed. The lockout threshold and duration are fully configurable.

✅ 🚨 One-Click Emergency Shield / Lockdown

Under active attack? Activate Emergency Lockdown with a single click to instantly tighten thresholds (2 attempts max, 60-minute lockdown) and defeat distributed bot attacks.

✅ 🍯 Bot Honeypot Auto-Ban

Instantly locks out automated bots targeting prohibited usernames (e.g. admin, root, administrator, test, system) on their very first attempt, saving database resources and thwarting brute-force dictionaries.

✅ 🛡️ Username Enumeration Shield

Stops attackers and tools like WPScan from discovering valid login usernames by shielding direct author queries (?author=1) and removing user lists from the WordPress REST API for unauthenticated visitors.

✅ 🔍 Threat Intelligence & Forensic Investigation

Integrated IP threat intelligence links (AbuseIPDB) directly in your activity logs and locked tables so you can investigate attacking IP reputations with one click.

✅ Trusted IP Allowlist

Add your own IP address (or CIDR range) to the allowlist so you are never accidentally locked out. Lockspire shows you your current IP on the management screen, and warns you if you are about to make a change that could affect your own access.

✅ Detailed Activity Log

Every failed and successful login attempt is logged to a dedicated database table with IP address, username, user-agent, and timestamp. Logs are filterable by event type and IP address, exportable to CSV, and automatically purged after a configurable retention period.

✅ Throttled Security Email Alerts

Receive an email when an IP is locked out. Alerts are automatically throttled (one per IP per configurable time window) so a sustained attack doesn’t fill your inbox. You can also receive optional alerts for successful logins.

✅ Security Health Check

A dedicated screen shows the real status of your site’s security configuration: login protection status, XML-RPC status, WordPress version, debug mode, wp-config.php permissions, default “admin” username detection, honeypot auto-ban, user enumeration shielding, and trusted IP setup. Each check links directly to the right settings to fix any issues found.

✅ XML-RPC & Pingback Shield

Completely disables XML-RPC and removes X-Pingback headers, eliminating common attack surfaces for brute-force and DDoS amplification attacks. Safe to disable for most sites.

Who is Lockspire for?

• WordPress site owners who want reliable brute-force protection without installing a heavyweight all-in-one security suite
• Developers managing client sites who need a simple, trustworthy plugin they can configure once and leave running
• Anyone who has been locked out of their own site before and wants a lockout recovery path built in

What Lockspire does NOT do

Lockspire does not scan for malware, provide a web application firewall, or offer country blocking. These features belong in a different category of plugin. Lockspire focuses exclusively on login access protection and does it reliably.

Privacy

Lockspire logs IP addresses, usernames, and browser user-agents for login events. This data is stored in your WordPress database and is never transmitted to external servers. It is automatically purged after your configured retention period (default: 30 days). We recommend documenting this in your site’s privacy policy.

Developer Information

Hooks available to developers:

lockspire_after_failed_login — Runs after a failed login attempt is recorded.

Parameters: $username (string), $ip (string), $attempt_count (int)

lockspire_after_lockout — Runs when an IP is locked out.

Parameters: $username (string), $ip (string)

lockspire_lockout_message — Filter the lockout message shown to the user.

Parameters: $message (string), $minutes (int), $seconds (int)

Option keys:
– lockspire_options — Main plugin settings array
– lockspire_trusted_ips — Allowlisted IPs and CIDR ranges
– lockspire_notification_emails — Additional alert recipient emails
– lockspire_email_logs — Sent email log (capped at 100)

Table: {prefix}lockspire_log — Login event log