Title: DadsFam Login Security Author: dadsfam Published: September 16, 2026 Last modified: September 16, 2026 --- Search plugins ![](https://ps.w.org/dadsfam-login-security/assets/banner-772x250.png?rev=3697870) ![](https://ps.w.org/dadsfam-login-security/assets/icon-256x256.png?rev=3697870) # DadsFam Login Security By [dadsfam](https://profiles.wordpress.org/dadsfam/) [Download](https://downloads.wordpress.org/plugin/dadsfam-login-security.1.7.1.zip) * [Details](https://wordpress.org/plugins/dadsfam-login-security/#description) * [Reviews](https://wordpress.org/plugins/dadsfam-login-security/#reviews) * [Installation](https://wordpress.org/plugins/dadsfam-login-security/#installation) * [Development](https://wordpress.org/plugins/dadsfam-login-security/#developers) [Support](https://wordpress.org/support/plugin/dadsfam-login-security/) ## Description **DadsFam Login Security** protects the most-attacked part of your WordPress site— the login form — without making you read a manual or fiddle with servers. Everything described below works on every site. Nothing is disabled, blurred out, time-limited or reduced. It watches failed logins, locks out attackers automatically, escalates repeat offenders to a longer ban, and keeps a clean log of everything so you can see exactly what’s hitting your site. #### What you get (free) * **Smart brute-force lockouts** — set how many tries are allowed and how long the lockout lasts. Repeat offenders get an automatic extended ban. * **IP allow & deny lists** — exact IPs, wildcards (`1.2.3.*`) and CIDR ranges (` 1.2.3.0/24`). IPv4 and IPv6. * **Full login activity log** — every failed login, success, lockout and block, with IP, username and device. Searchable, filterable, auto-pruned. * **Live dashboard** — failed-login stats, a 14-day chart, top attacking IPs, and who’s locked out right now (with one-click unblock). * **Email alerts** — get a tidy, throttled email when a lockout triggers. * **Generic login errors** — stop attackers learning whether a username exists. * **Honeypot bot trap** — an invisible field that catches dumb bots. * **Hardening** — block user enumeration (`?author=N` and the REST API), kill XML- RPC pingback amplification, or disable XML-RPC entirely. #### Pro Features (DadsFam Login Security Pro add-on) The optional **DadsFam Login Security Pro** add-on plugs into the same screens and adds two-factor authentication (authenticator apps and email codes, with backup codes and trusted devices), CAPTCHA on the login form (Google reCAPTCHA, hCaptcha, Cloudflare Turnstile or a built-in maths question), a custom hidden login address, a branded login screen, strong-password and breached-password checks, idle auto- logout, scheduled security reports, and country blocking. #### A word about PRO Right, let me be straight with you, because I hate being sold to as much as you do. Everything above is free and it stays free. The lockouts, the allow and deny lists, the activity log, the live dashboard, the email alerts, the bot traps and the hardening— none of those are premium features. Those are the things a login-security plugin should just do, and if I put them behind a paywall I would be taking the mickey. There is a PRO add-on. It exists because I am a dad in Cape Town, and this is one of the things that puts food on the table at my house. That is the honest reason. Not “unlock your potential”, not “supercharge your workflow”. Just: if this plugin kept the bots off your login page and you can spare it, PRO helps me keep building. What PRO adds is the second layer you reach for once the door is already locked — two-factor codes, a CAPTCHA, a hidden login address, breached-password checks, country blocking. That is extra security and convenience. It is not the plugin working properly, because the plugin already works properly. So if the free one does everything you need, brilliant. Genuinely. Use it, and I hope your activity log stays boring. If you get to the point where a second factor or a hidden login would let you sleep better, PRO is at plugins.dadsfam.co.za. Either way, thanks for using something I built. — Zak, DadsFam ## Screenshots [⌊The dashboard: protection status in one sentence, a finish-locking-down checklist, live stats, the 14-day chart and who is locked out right now.⌉⌊The dashboard: protection status in one sentence, a finish-locking-down checklist, live stats, the 14-day chart and who is locked out right now.⌉[ The dashboard: protection status in one sentence, a finish-locking-down checklist, live stats, the 14-day chart and who is locked out right now. [⌊Activity: every sign-in attempt, filtered with one click, with “Block for good” on any row.⌉⌊Activity: every sign-in attempt, filtered with one click, with “Block for good” on any row.⌉[ Activity: every sign-in attempt, filtered with one click, with “Block for good” on any row. [⌊Settings: pick Relaxed, Balanced or Strict, flip plain-English switches, and put your own address on the allow list with one click.⌉⌊Settings: pick Relaxed, Balanced or Strict, flip plain-English switches, and put your own address on the allow list with one click.⌉[ Settings: pick Relaxed, Balanced or Strict, flip plain-English switches, and put your own address on the allow list with one click. ## Installation 1. Upload the plugin folder to `/wp-content/plugins/`, or install the ZIP via **Plugins Add New Upload Plugin**. 2. Activate it through the **Plugins** menu. 3. Head to **Login Security** in the admin sidebar. Sensible defaults are already on — tweak the numbers under **Settings** if you like. ## FAQ ### Will this lock me out of my own site? It locks out by IP after repeated _failed_ logins. Add your own IP to the **Allow list** under Settings to be safe. If you ever get stuck, lockouts expire on their own, or you can clear the `wp_dfls_lockouts` database table. ### Does it work behind Cloudflare or a load balancer? By default it uses the real connection IP (`REMOTE_ADDR`), which can’t be spoofed. If you’re behind a trusted proxy, you can return the forwarded header using the ` dfls_client_ip` filter. ### Is it compatible with WooCommerce login forms? Yes — the honeypot and protection also apply to the WooCommerce login form. ### Will disabling XML-RPC break anything? Disabling just **pingbacks** is safe for nearly everyone. Disabling XML-RPC **completely** can affect the WordPress/Jetpack mobile app and some remote-publishing tools, so that option is off by default. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “DadsFam Login Security” is open source software. The following people have contributed to this plugin. Contributors * [ dadsfam ](https://profiles.wordpress.org/dadsfam/) [Translate “DadsFam Login Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/dadsfam-login-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/dadsfam-login-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/dadsfam-login-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/dadsfam-login-security/) by [RSS](https://plugins.trac.wordpress.org/log/dadsfam-login-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.7.1 * Removed the small “Powered by DadsFam” line from the bottom of the lockout and new-login emails. Those emails go to your users, and nothing of ours belongs in them unless you have asked for it. * Corrected the plugin’s homepage link in its header, which pointed at a page that no longer exists. #### 1.7.0 * New: find any setting. A search box above the Settings cards filters every switch and field by a word in its label or description, opens the “actual numbers” section when a match is inside it, and says plainly when nothing matches. * New: the save bar tells you. It lights up the moment something on the page changes and the browser warns before you leave with unsaved changes. * Readme: added the standing “A word about PRO” note — what stays free, why the optional add-on exists, and what it actually adds — and the line that nothing in the free plugin is disabled, blurred out, time-limited or reduced. Tested up to WordPress 7.1. #### 1.6.1 * Fixed: cleared every WordPress.org Plugin Check violation — six request values read without sanitising, a discouraged text-domain call, and a set of table-name and nonce false positives now carry the justification the checker needs. Zero violations. * Fixed: a CAPTCHA refusal raised by another plugin was counted as a failed password. A visitor turned away by a bot check a few times was then locked out here as well — two plugins compounding one problem. Any error whose code mentions a CAPTCHA is now ignored when counting failed attempts, whichever plugin raised it. Wrong passwords still count exactly as before. #### 1.6.0 * New: the whole admin screen has been rebuilt in the DadsFam house style — one calm, tabbed screen (Dashboard · Activity · Settings) that leads with what is true right now and what to do about it, in plain English. Protection status at a glance, a “finish locking things down” checklist that disappears once you’re done, big tap-tiles, and an “if something goes wrong” panel with the fix written right there. * New: “Never lock me out” — one click puts your own address on the allow list, from the dashboard or the checklist. * New: instant lockout for bot usernames. Anyone trying “admin”, “root”, “test” and friends when no such account exists is a bot; they’re locked out on the first try instead of the fifth. Real accounts with those names are never affected. The list is editable. * New: protection levels. Pick Relaxed, Balanced (recommended) or Strict instead of juggling five numbers — the numbers are still there for people who want them. * New: Cloudflare and proxy support. Behind Cloudflare, every visitor used to look like the same address, so one bot could lock out your whole site. Choose “Cloudflare” or “Another proxy” under Settings Where visitors’ addresses come from; forwarded headers are only ever trusted when the request genuinely came from the proxy, so nobody can fake their address. The dashboard warns you if it spots Cloudflare and the setting is still on “plain hosting”. * New: a recovery valve for the free plugin. Add `define( 'DFLS_DISABLE_LOCKOUTS', true );` to wp-config.php and every lockout is switched off until you remove it. The dashboard shows a red warning while it is in place. * New: “Let everyone back in” clears every active lockout at once; “Block for good” on any row moves an address to the deny list. * New: the activity log shows “Chrome on Windows” instead of a 200-character user agent, filters with pills, and lets you block an attacker straight from the row. * Improved: locked-out addresses hammering a real account no longer cost a password- hash check per attempt — the lockout is now applied before the (deliberately slow) password comparison. * Improved: dashboard statistics come from one query instead of five, and are memoised per request. * Improved: the live dashboard pauses when the tab is hidden and refreshes the moment you come back. * Changed: minimum WordPress version is now 6.0. Tested up to 7.0. #### 1.5.5 * Fixed: the honeypot bot trap could block genuine sign-ins when a password manager( 1Password, LastPass, Bitwarden, browser autofill) filled the hidden field on the visitor’s behalf. The trap now ignores values that simply mirror what the visitor legitimately typed, so real people get in and bots still get caught. * Improved: the honeypot field now carries the ignore hints password managers actually respect, so most of them skip it entirely. #### 1.5.4 * New: a clear warning on the plugin’s admin pages when a known conflicting login/ 2FA plugin (e.g. Loginizer) is active at the same time — running two can break sign-in. * Improved: translation-ready — the plugin now loads its text domain from a /languages folder. #### 1.5.3 * Performance: added a composite database index (status + time) so the dashboard statistics and charts stay fast even with very large activity logs. The index is added automatically on update. #### 1.5.2 * Improved: the Activity Log now labels email-link (magic-link) sign-ins from the Pro add-on. * Hardened: the new-sign-in email alert is wrapped so it can never interfere with logging in. #### 1.5.1 * Improved: the Activity Log now labels passkey events (passkey added, removed, sign-in) written by the Pro add-on. #### 1.5.0 * New: optional new-sign-in email alert — the account owner is emailed when their account is signed into from an IP not seen before (opt-in under Settings Notifications; the first login is remembered silently). * New: export the activity log to CSV from the Activity Log page. * New: filter the Activity Log by two-factor / security audit events (2FA on/off, device trusted/removed, codes reset). #### 1.4.1 * Improved: the Activity Log now shows two-factor audit events (2FA on/off, device trusted/removed, backup codes reset) with their own clear labels. * Improved: the live dashboard ticker stays focused on genuine login attempts. #### 1.4.0 * New: live attack arcs — glowing comet trails streak across the threat sphere from each attacker to a marker representing your site. * New: ambient pulse rings radiate from the security-score gauge, tinted to your current status. * New: a soft cursor-follow spotlight glides across each panel for a premium, fluid feel. * New: unblocking an IP now plays a satisfying “zap” as the row clears. * Accessibility: all new effects switch off with “reduce motion”. #### 1.3.0 * New: rotating 3D wireframe “threat sphere” that plots live attack activity. * New: hacker-style “decode” animation — stat numbers and the security score scramble, then lock in, on load. * New: a glowing scan line sweeps across the failed-logins chart. * New: subtle animated aurora glow behind the whole dashboard (light & dark). * Accessibility: all of the above switch off automatically with “reduce motion”. #### 1.2.0 * New: live “security console” dashboard — an animated Protection Score gauge that reacts to real-time conditions. * New: live activity ticker and a sweeping attack radar that plots your top attacking IPs. * New: animated constellation backdrop, 3D-tilt stat cards, and glowing animated panel borders. * New: one-click Dark Mode (remembered between visits) and an optional alert sound when a new lockout happens. * Accessibility: every effect is disabled automatically when “reduce motion” is on; sound is off by default. #### 1.1.0 * New: live, self-refreshing security dashboard — stats update automatically every 12 seconds with no page reload. * New: animated 14-day failed-login chart with hover tooltips and smooth transitions. * New: animated count-up stat cards, and at-a-glance summary cards on the Activity Log page. * Improved: premium glass UI across the dashboard, log and settings pages. * Accessibility: all animations honour the “reduce motion” system setting. #### 1.0.0 * Initial release: brute-force lockouts, IP allow/deny lists, activity log, dashboard, email alerts, honeypot, generic errors, and hardening (user-enumeration, XML- RPC, pingback). ## Meta * Version **1.7.1** * Last updated **23 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [Brute Force](https://wordpress.org/plugins/tags/brute-force/)[limit login attempts](https://wordpress.org/plugins/tags/limit-login-attempts/) [lockout](https://wordpress.org/plugins/tags/lockout/)[login](https://wordpress.org/plugins/tags/login/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/dadsfam-login-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/dadsfam-login-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/dadsfam-login-security/reviews/) ## Contributors * [ dadsfam ](https://profiles.wordpress.org/dadsfam/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/dadsfam-login-security/)