Loginizer-Security

Loginizer-Security Pro extends Loginizer’s WordPress login controls with additional ways to verify users, manage access, and check core files. Administrators configure the settings in WordPress and select which controls fit their website.

Failed attempts and IP access

By default, Loginizer blocks an IP address for 15 minutes after three failed login attempts. After multiple lockouts, the block lasts 24 hours. Administrators can change these settings on the brute-force page.

• Review failed-login logs and blacklist or whitelist IP addresses and ranges.
• Allow logins only from trusted IP addresses, or show a blocked screen instead of the login page.
• Customize failed-login messages and receive email notifications after successful logins.
• Check permissions for important files and folders.

Login methods and verification

Passwordless Login asks for a username or email address, then sends a temporary login link to that account’s email address. Email-based two-factor authentication sends a temporary six-digit code after the user enters login details. Users can configure app-based two-factor authentication with apps such as Google Authenticator or Authy, or use passkeys to sign in without a password.

A user can set a challenge question and answer as an additional login check. Loginizer also works with social sign-in with providers including Google, GitHub, Facebook, X, Discord, Twitch, LinkedIn, and Microsoft. Single Sign-on can make temporary dashboard access for another user without sharing the account’s username or password. Administrators can set a concurrent-login limit and choose what happens when a user reaches it.

CAPTCHA and login routes

Administrators can configure Google reCAPTCHA v2 or v3, Cloudflare Turnstile, or hCAPTCHA for the login screen, comments, registration, and supported WooCommerce forms. CAPTCHA is also supported for Contact Form 7 and WPForms.

Loginizer can change the login-page slug from wp-login.php and rename the administration URL from wp-admin to a custom value such as website-admin. With Rename Login with Secrecy enabled, login URLs still point to wp-login.php, and users must enter the new slug directly in their browser. CSRF Protection adds a session string to the administration URL.

Additional site controls and file checks

• Disable or rename XML-RPC and disable pingbacks.
• Block access from selected countries, prevent username enumeration, or block new registrations from specified email domains.
• Automatically blacklist IP addresses when configured usernames are used in login attempts.
• Use MD5 Checksum to check WordPress core files, review the results, and ignore files where appropriate.

Setup and support

1. Install and activate Loginizer-Security Pro in WordPress.
2. Review brute-force settings, login logs, and IP rules.
3. Choose the authentication methods and account access controls to enable.
4. Configure CAPTCHA and any custom login or administration URLs.
5. Run the core-file checksum check and review its results.

Loginizer-Security Pro includes professional support through the Premium Support Ticket System. Free Loginizer users can use the community support forums.