Brute-force lockout
Progressive delays escalating to a hard lockout after repeated failures, tracked by hashed IP and username. Error messages stay generic — they never reveal whether a username exists.
Oiko / plugins / guard
Login security
Oiko Guard
Login hardening and two-factor authentication in one lean plugin — replacing the three or four separate free plugins most sites stitch together to lock down wp-login.php.
free forever · no pro tier · no ads · nothing phones home
Price£0 — full feature set
Two-factorTOTP, RFC 6238
CAPTCHATurnstile or reCAPTCHA
Audit retention90 days, GDPR-wired
Release gateWP HealthKit audit
One, not fourLockout, 2FA, CAPTCHA and hardening in a single plugin — no stitched-together stack.
Itself auditedEvery tagged release passes WP HealthKit's own scanner before it publishes.
Secrets encryptedTOTP secrets and keys encrypted at rest with sodium — never plaintext.
Nothing left behindUninstall removes every table, option and cron the plugin added.
What it does
Every layer of the login, hardened.
From the first honeypot check to the audit log you review afterwards — Guard covers the whole path an attacker would take.
Two-factor, done properly
TOTP with any standard authenticator app. Opt-in per user by default; admins can require it per role with a grace-period nag before enforcement bites.
One-time recovery codes
Generated at enrolment, shown once, stored hashed. Losing your phone means a recovery code — not a database edit.
CAPTCHA, your choice
Cloudflare Turnstile or reCAPTCHA, verified server-side. A hidden honeypot and time-trap run first, so most bots never trouble the CAPTCHA — or your users.
A quieter attack surface
XML-RPC closed, pingback and RSD headers removed, ?author=N probing blocked, and usernames stripped from unauthenticated REST and oEmbed responses.
Optional custom login URL
Set a secret slug and wp-login.php stops answering direct hits — QA'd against password resets, registration and WooCommerce login forms before every release.
Login audit log
Every attempt recorded — IP, user agent, time, result — with a 90-day retention cap and pruning cron, wired into WordPress's personal-data export and erase tools.
Sessions & new-device alerts
See every active session, revoke one or log out everywhere. An email fires on the first login from an unrecognised device — rate-limited, so alerts stay meaningful.
Why it exists
Security is the premise, not the upsell.
Most login-security plugins are a free taste of a paid one — the firewall, the real lockout rules, the audit trail all live behind a pro tier. Guard inverts that: the whole feature set is free, because the point is to prove the standard Oiko builds to.
So every release is run through WP HealthKit's own audit before it ships. The scanner we sell is the same one standing between this plugin and the WordPress.org directory.
- 01Constant-time comparisons on TOTP and recovery codes — no timing attacks.
- 02Every settings, enrolment and revoke action nonce- and capability-checked.
- 03Attacker-controlled strings in the audit log escaped on every render.
- 04Only the pre-authentication lockout check runs without a login — nothing else.
Built the Oiko way
oiko-plugin-boilerplatePHP 8.3+ · WP 6.7+PHPUnit + WP_MockPHPCS / PHPStan cleanwp.org Plugin CheckGDPR export & erase
Questions
Fair ones.
Which authenticator apps work?+
Any RFC 6238 app — 1Password, Bitwarden, Authy, Google Authenticator, and the rest. Enrolment is a QR code in your profile; recovery codes are generated at the same moment.
What if I lock myself out?+
Lockouts are progressive and time-boxed, recovery codes cover a lost authenticator, and nothing in Guard can disable your own admin account. Worst case, renaming the plugin folder over SFTP releases everything — the same escape hatch as any well-behaved WordPress plugin.
Does it work with WooCommerce and custom login forms?+
Yes. Guard hardens WordPress's own authentication rather than replacing it, so theme and WooCommerce login forms keep working. The custom-login-URL module is manually QA'd against password reset, registration and WooCommerce account flows before every release.
Also free