Login Security Features

Attack-defense features

Brute-force protection Default ON

IP-level lockouts after repeated failed sign-in attempts. Defaults: 5 attempts within 15 minutes triggers a 15-minute lockout; 3 lockouts on the same IP escalates to a permanent ban. Configurable under GuardPress → Settings → Brute Force Protection.

Setup guide: Brute-Force Protection Setup.

Login CAPTCHA Default OFF

CAPTCHA challenge on the sign-in form. GuardPress supports Cloudflare Turnstile (recommended for privacy), Google reCAPTCHA v2 / v3, and hCaptcha. Enabled per-form so you can require CAPTCHA on wp-login.php but not on WooCommerce checkout.

Setup guides: Cloudflare Turnstile Setup, and CAPTCHA Blocks WC / MemberPress Login for the common integration pitfall.

Two-Factor Authentication Default OFF

TOTP-based second factor for user sign-in. Uses any RFC 6238 authenticator app (Authy, Google Authenticator, 1Password, Bitwarden, Microsoft Authenticator). Ten single-use backup codes generated per user for recovery. Off by default because you have to opt in with an authenticator app in hand.

Setup guide: Setting Up Two-Factor Authentication. Recovery: 2FA Recovery.

Per-role 2FA enforcement Default OFF

Requires 2FA for users in specified roles. When you add a role to the enforced list, existing users in that role get a 7-day grace period (banner shown at every admin view) before the hard redirect to the setup page kicks in.

Setup guide: Per-Role 2FA Enforcement Setup.

Visibility features

Sign-in notifications Default OFF, on for admins when enabled

Emails the user themselves every time their account successfully signs in. If an admin account is compromised, the rightful owner gets a notification with the IP and a one-click password-reset link, even if the attacker later clears the email from their inbox. Default enabled roles: Administrator only. Per-role allow-list configurable.

Setup guide: Sign-In Notifications Setup.

Hardening features

Custom login URL Default OFF

Renames /wp-login.php to a custom slug of your choice. Not primary defense (a determined attacker who knows the site runs WordPress can still find the login form via fingerprinting), but it silences most automated brute-force scanners because they hit the standard URL and get a 404. Use as an ergonomics improvement to reduce noise on the brute-force logs, not as a security guarantee.

Warning: forgetting the custom slug locks you out of your own site. Save it somewhere before enabling.

Password strength enforcement Default OFF

Enforces minimum length and complexity on user passwords at registration and change time. Off by default because WordPress core ships a password strength indicator that’s usually adequate; enable when your compliance requirements demand explicit policy enforcement.

Emergency response

Emergency Lockdown Default OFF, panic-button

Site-wide kill switch for the sign-in surface. When enabled, all new sign-ins are denied until you flip it off. Existing sessions are unaffected, so you don’t log yourself out while responding. Use when you’re investigating a compromise, when a credential leak is confirmed, or when brute-force protection isn’t stopping a sustained attack.

The define('GUARDPRESS_EMERGENCY_BYPASS', true); wp-config constant provides a file-edit-only bypass so an admin whose session expired mid-lockdown can regain access via SFTP.

Recovery guide: Emergency Lockdown Recovery.