Login Lockdown Pro

Login Lockdown Pro extends Login Lockdown & Protection with several ways to manage access to a WordPress site. Choose controls based on what you need to limit: repeated login attempts, users from selected countries, or access shared across multiple sites.

When an IP exceeds the login limit

The plugin records the IP address and time of failed login attempts. You pick the number of attempts and the period they occur within. Once an IP exceeds that limit, you can disable login requests from it or block it from accessing the website entirely.

The default lockout is one hour after three failed attempts within five minutes. Change these values in the options. Administrators can release locked IP addresses from the panel, and the detailed log lists failed attempts and IP locks.

When access depends on location or CAPTCHA

Country blocking can prevent visitors from selected countries from accessing the site, or only prevent them from logging in. You can display blocked visitors a custom message explaining why access is unavailable.

Choose among five CAPTCHA versions: the built-in option, two Google options, Cloudflare Turnstile and hCaptcha. The two Google options and hCaptcha are Pro functions. The built-in CAPTCHA is GDPR compatible.

When login also requires email access

Email-link two-factor authentication adds a confirmation step after a visitor enters a username and password. The user must follow a unique link sent to their email inbox. This option does not require a code-generating app such as Google Authenticator.

When you manage several sites

Cloud Protection delivers a dashboard, described as a SaaS service for managing multiple sites. Use it to manage IP whitelists and blacklists, then apply those lists across the sites you manage.

When someone needs access for a limited time

Temporary Access creates a link that lets another person enter without receiving a username or password. Set how long the link remains active and its maximum number of uses. Choose an access level from the available roles, such as administrator, editor or author.

Configure and administer the plugin

Open Settings > Login Lockdown. Choose the failed-attempt threshold, time period and lockout behavior, then review the log and release locked IPs manually when needed. Configure country restrictions, CAPTCHA, email-link authentication, cloud IP lists or temporary access according to the site's access requirements.

To install, extract the plugin into its own folder in the add-ons directory and activate it in WordPress. To disable it, use the Plugin overview page in the WordPress admin area, or rename /wp-content/plugins/login-lockdown/ through FTP access.