WM Login Shield

wp-login.php is the most attacked URL on the internet. Every public WordPress site gets probed for weak credentials — it’s automated, constant, and largely invisible until it succeeds. WM Login Shield adds the three layers that stop the vast majority of attacks: rate limiting, two-factor authentication, and real-time lockout alerts.

Rate limiting tracks login attempts per IP and locks out the source after a configurable threshold (default: 5 failures in 10 minutes). Your own IP is automatically added to the allowlist on activation, so you can’t accidentally lock yourself out during setup. If you do find yourself locked out, defining WM_LOGIN_SHIELD_BYPASS in wp-config.php provides a recovery path without needing server access. Optional geo-blocking via the MaxMind GeoLite2 database (free license required) lets you restrict logins to specific countries if your user base is geographically predictable.

Two-factor authentication is self-service: users enrol a TOTP authenticator from their profile page and any standard TOTP app — Google Authenticator, Authy, 1Password — works immediately. Admins can mandate 2FA for specific roles, so you can require it for administrators and editors without forcing it on lower-privilege users. Every lockout triggers an email to the site admin with the IP, timestamp, and attempted username, giving you a real-time signal when an attack is in progress rather than finding out weeks later in a server log.