Description
IC Security Guard is a lightweight, all-in-one security hardening plugin that protects your WordPress site from brute force login attacks, REST API abuse, and XML-RPC amplification attacks — and keeps your site owner informed in real time when an attack is blocked.
Instead of leaving wp-login.php, /wp-admin, xmlrpc.php, and the REST API open for anyone to probe, IC Security Guard lets you move your login page to a custom secret URL, lock out anyone who fails to log in too many times, require a one-time email code before login completes, shut down common XML-RPC and REST API attack vectors, and get emailed the moment something is blocked.
Special Features
Hide Default Login Page
- Hide the default
wp-login.phpand/wp-adminlogin pages from unauthenticated visitors - Serve the login form only on a custom, secret URL that you choose
- Redirect anyone hitting the default login URL to a page of your choice, or a plain 404
- Logged-in users always pass through untouched — no impact on legitimate access
Login Attempt Limiting & Lockout
- Limit failed login attempts with a configurable maximum
- Automatic lockout for a configurable duration after too many failed attempts
- Live countdown timer shown on the login form while locked out
- Lockout state persists across page reloads and resets automatically once it expires
- Correct credentials are still rejected while a lockout is active
Email OTP Two-Factor Authentication
- Optional two-factor authentication using a one-time code sent by email
- After a correct username and password, the user is redirected to a dedicated verification page
- A 6-digit code is emailed to the account’s registered email address and must be entered to complete login
- Configurable code expiry, limited verification attempts, and a resend cooldown to prevent abuse
- Automatically skipped for REST API and XML-RPC requests so API clients and integrations are not broken
REST API & XML-RPC Brute Force Protection
- Optionally disable XML-RPC entirely, closing off
system.multicall-based amplification attacks that let attackers test hundreds of password combinations in a single request - Optionally block unauthenticated REST API user enumeration (
/wp-json/wp/v2/users) so attackers cannot harvest valid usernames - Failed REST API and XML-RPC authentication attempts share the same per-IP lockout as the login form, so an attacker locked out on one entry point is locked out everywhere
Real-time Email Alerts
- Get notified by email the moment a security event is blocked: a login lockout, a blocked XML-RPC request, or a blocked REST API user-enumeration attempt
- Each alert includes the event type, the offending IP address, and the time it occurred
- A configurable cooldown period per alert type keeps a sustained attack from flooding your inbox
- Alerts are sent to your site’s admin email address and are fully optional
Screenshots
Installation
- Upload the plugin folder to the
/wp-content/plugins/directory, or install the plugin directly through the WordPress Plugins screen. - Activate the plugin through the “Plugins” screen in WordPress.
- Go to Settings IC Security Guard to configure the plugin.
- On the General Settings tab:
- Enable login attempt limiting and set your maximum failed attempts and lockout duration.
- Optionally enable “Email OTP Two-Factor Authentication” and set the OTP code expiry.
- Optionally enable “Disable XML-RPC” and “Block REST API User Enumeration”.
- Optionally enable “Real-time Email Alerts” and set an alert cooldown.
- On the Hide Default Logged-in tab, enable “Hide Default Login Pages”, set your new secret login slug, and optionally set a redirect target for blocked visitors.
- Save your changes and bookmark your new login URL before logging out.
FAQ
-
What happens if I forget my new login URL?
-
You can always reach your site’s database (via phpMyAdmin or your host) and update the
icsegu_hidelogin_optionsoption in thewp_optionstable to disablehide_login_url, restoring access to the defaultwp-login.php. -
Will this lock me out of my own site?
-
Logged-in users are always allowed through to
/wp-adminregardless of the hidden login setting. The failed-login lockout only applies to failed authentication attempts, and resets automatically once the configured lockout duration passes. -
Does this plugin affect logged-in users?
-
No. Logged-in users pass through untouched. The hidden login, lockout, REST API, and XML-RPC protections only apply to unauthenticated visitors and failed authentication attempts.
-
Where is the lockout state stored?
-
Lockout state is stored per IP address using WordPress transients, so it persists across page reloads and works with whatever caching layer your site already uses. The same lockout state is shared by the login form, the REST API, and XML-RPC.
-
How does Email OTP Two-Factor Authentication work?
-
When enabled, after a user enters the correct username and password, they are redirected to a dedicated verification page and emailed a 6-digit code (sent to their WordPress account email address). The code must be entered within the configured expiry window to complete login. Codes can be resent with a short cooldown between requests, and login only completes after the correct code is verified. This step is automatically skipped for REST API and XML-RPC requests, since application passwords and API integrations authenticate programmatically and have no page to display a challenge on.
-
What does disabling XML-RPC protect against?
-
XML-RPC’s
system.multicallmethod allows an attacker to test many username/password combinations in a single HTTP request, bypassing typical per-request throttling. Enabling “Disable XML-RPC” turns off the XML-RPC endpoint entirely. If you rely on XML-RPC for a mobile app, Jetpack, or another integration, leave this option off — any failed XML-RPC login attempts are still covered by the shared lockout. -
What does blocking REST API user enumeration protect against?
-
By default, WordPress’s REST API exposes a list of registered usernames at
/wp-json/wp/v2/usersto anyone, even when logged out. Attackers use this to harvest valid usernames before a brute-force attempt. Enabling “Block REST API User Enumeration” returns an authorization error for unauthenticated requests to this endpoint, while logged-in requests are unaffected. -
Will I get an email for every single failed login?
-
No. Real-time email alerts are sent once per alert type whenever an event first triggers, then suppressed for the configured cooldown period (15 minutes by default) even if the same type of event keeps happening. This keeps you informed without flooding your inbox during a sustained attack.
-
Is .htaccess or wp-config.php hardening included?
-
Those sections are currently marked “Coming soon” in the plugin settings and will be added in a future release.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“IC Security Guard” is open source software. The following people have contributed to this plugin.
Contributors
Translate “IC Security Guard” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.0
- Added optional REST API & XML-RPC brute force protection: disable XML-RPC entirely, block unauthenticated REST API user enumeration, and share the login lockout state across the login form, REST API, and XML-RPC.
- Added optional real-time email alerts for login lockouts, blocked XML-RPC requests, and blocked REST API user-enumeration attempts, with a configurable per-alert-type cooldown.
- Email OTP Two-Factor Authentication is now automatically skipped for REST API and XML-RPC requests to avoid breaking application password and API-based logins.
1.1.0
- Added optional Email OTP Two-Factor Authentication with a dedicated verification page.
1.0.0
- Initial release.
- Hide default login page and serve login only on a custom URL.
- Configurable failed login attempt limiting with automatic lockout.
- Live countdown timer on the login form during lockout.