Saral Login Shield

Saral Login Shield protects your WordPress login three ways: it asks for a code from your phone after the password, moves the login page to an address only you know, and stops password-guessing bots. Direct visits to wp-login.php and /wp-admin get a 404 page (or a redirect of your choice).

Two-factor login

• After the password, users enter a 6-digit code from an authenticator app such as Google Authenticator, Microsoft Authenticator, Authy or 1Password. No phone number, outside service or account is needed: the codes are made on your site and on the phone.
• Each user turns it on in their profile in under a minute. You can require it for administrators.
• 10 one-time backup codes for a lost phone, and “Don’t ask again on this device for 30 days”.
• Works with the normal login page and with front-end login forms that use WordPress’s login, such as WooCommerce’s My Account page.
• Logins from apps through XML-RPC need an application password once two-factor login is on, so a stolen password alone can’t be used there either.

Hide the login page

• Change your login URL to any slug you like. New sites get a random one, such as /login-k3x9qa.
• Block direct access to wp-login.php and /wp-admin for logged-out visitors (404 or redirect).
• No core files are modified. Works in sub-directory installs, with WP-CLI and cron, and with front-end forms that post to admin-post.php.

Stop password guessing

• Limit login attempts: after 5 failed logins within 20 minutes (you can change both), the IP address is locked out for 20 minutes. Even the correct password is refused during a lockout. It also covers logins through XML-RPC.
• Turn off XML-RPC: one switch blocks xmlrpc.php, which bots use to guess passwords without ever visiting the login page.
• Works behind Cloudflare and proxies: choose where the visitor’s IP address comes from, so visitors aren’t all locked out together.

See who logs in

• Login activity: every login, failed login, lockout and recovery email, with the username, IP address and browser. Filter by event, and unblock a locked-out IP address with one click.
• New IP alerts: administrators get an email when their account signs in from an IP address it hasn’t used before.

Never get locked out of your own site

• Forgot your login URL? Go to yoursite.com/?login-recovery, enter your administrator email address and the login URL is emailed to you. The page answers the same way for every address, so it doesn’t reveal who your administrators are, and it sends at most 3 emails an hour.

What it doesn’t do: Saral Login Shield doesn’t scan for malware or act as a firewall, so keep using strong passwords and regular updates.

More details and screenshots: Saral Login Shield on saraltechies.com

Third-party code: The setup QR code is drawn in the browser by qrcode-generator 1.4.4 by Kazuhiko Arase, included unchanged in assets/js/qrcode.js under the MIT license. It runs only on the profile page while two-factor login is being set up, and sends nothing anywhere. “QR Code” is a registered trademark of DENSO WAVE INCORPORATED.