Title: Smarto Login Security Author: Shahadat Published: November 13, 2026 Last modified: November 13, 2026 --- Search plugins ![](https://ps.w.org/smarto-login-security/assets/banner-772x250.png?rev=3798871) ![](https://ps.w.org/smarto-login-security/assets/icon-256x256.png?rev=3798871) # Smarto Login Security By [Shahadat](https://profiles.wordpress.org/sshahadatgsm/) [Download](https://downloads.wordpress.org/plugin/smarto-login-security.1.0.0.zip) * [Details](https://wordpress.org/plugins/smarto-login-security/#description) * [Reviews](https://wordpress.org/plugins/smarto-login-security/#reviews) * [Installation](https://wordpress.org/plugins/smarto-login-security/#installation) * [Development](https://wordpress.org/plugins/smarto-login-security/#developers) [Support](https://wordpress.org/support/plugin/smarto-login-security/) ## Description Smarto Login Security brings the controls for how people sign in to your site into one place: where they sign in, how they prove who they are, and what happens to their sessions afterwards. Every rule is enforced on the server when credentials are checked. A hidden URL or a missing button is never the only protection. #### Login URL and redirects * Move the login page to your own address and hide `wp-login.php` and `wp-admin` from visitors. * See which IP addresses tried to sign in on your hidden address, so you know if it leaked. * Choose the default page after login and logout, and with WooCommerce a separate page after signing in on My Account. Redirects are limited to your own site. * Staff (anyone who can use the dashboard) sign in only on the custom login URL, on by default and can be switched off. Every other login form, such as WooCommerce My Account or other plugins’ login pages, answers “wrong username or password” even with the right password, and you get an email alert. A list shows where people really sign in, found automatically from the Login History. #### Two-factor authentication * Authenticator apps (TOTP), set up with a QR code and confirmed before activation. * Email codes. * Single-use backup codes. * Require 2FA for chosen roles. Choose what happens to users who have not set up a method yet: remind them, send them email codes at every sign-in, or require setup before they can use the dashboard. * No session is created until the second factor is passed. #### Brute-force and abuse protection * Failed-login limits per IP address and per account, shared by every login form, with lockouts that double each time they repeat. The error tells people how many attempts they have left, and a locked visitor sees the lockout as soon as they open the login page. IPv6 addresses are counted per network, so switching addresses does not reset the count. * Rate limits for password reset and registration. * CAPTCHA with your choice of Cloudflare Turnstile, Google reCAPTCHA (v3, v2 invisible or v2 checkbox) or hCaptcha (checkbox or invisible) on login, registration, lost- password and new-password forms, including WooCommerce. Theme, size, badge position and language options, an option to show it only after failed sign-ins, and a key test that runs a real check with your keys before you save them. Always verified on the server. * Username enumeration protection: one error message for wrong usernames and wrong passwords, the same response to password-reset requests for unknown accounts, blocked `?author=N` lookups, and a hidden REST user list. * IP blocklist and allowlist with IPv4, IPv6 and CIDR ranges. Forwarded headers are trusted only from proxies you list. * XML-RPC and application passwords: block sign-ins over XML-RPC (pingbacks still work) or turn XML-RPC off completely, and allow application passwords for everyone, administrators only or nobody. #### Sessions and accounts * Active Sessions screen: who is signed in, last activity, sign-in time, IP address and country, browser and sign-in method. Your own session is marked, and you can end all your other sessions in one click. * End one session or all of a user’s sessions. Ending a session revokes it in WordPress, so the cookie stops working immediately. * Suspend accounts temporarily or permanently, with an internal reason. Suspended users are signed out everywhere and refused by every login form, XML-RPC and application passwords. * Login History of sign-ins, failures and blocks with country, filters and configurable retention. The country is looked up in a database included with the plugin, so no IP address leaves your site. * Admin Activity: changes made to this plugin (settings, IP rules, suspensions, ended sessions, 2FA changes), with who made them and the affected user. * Choose how long each log is kept (30 days by default) or switch it off. Logs cannot be deleted by hand, so an intruder cannot cover their tracks. * Email alerts for lockouts, administrator logins from new IP addresses, suspensions, settings changes and provider failures, grouped so attacks don’t flood your inbox. #### WooCommerce * The WooCommerce My Account login, registration, lost-password and new-password forms get the same protection. Checkout is never modified. * A Diagnostics page tests your login address and reports conflicts and what is and is not covered. #### Smarto Login Security Pro Everything above is free and works without an account. Smarto Login Security Pro is a separate plugin, sold on wpsmarto.com, that adds role-specific and exclusive login routes, redirects by role and user, SMS codes, passwordless sign-in, temporary access links, live online status, roles limited to trusted IP addresses, and role and IP rules for other plugins’ login forms. #### What it does not do * It is not a firewall or malware scanner. * Hiding the login URL reduces automated attacks; it does not replace strong passwords and 2FA. * Application passwords are separate credentials and do not ask for 2FA (WordPress design). Suspensions and lockouts still apply to them, and you can limit them to administrators or turn them off. * Login forms that create sessions without using WordPress authentication are covered only partly. See the Diagnostics page. ### External services The plugin contacts external services only when you configure them. Nothing is sent to WP Smarto, and the plugin includes no tracking or analytics. #### Cloudflare Turnstile (optional) Used to tell people from bots on the forms you choose. When a visitor loads a protected form, their browser loads Cloudflare’s script from challenges.cloudflare.com, which collects device and browser data. When the form is submitted, your site sends the token and the visitor’s IP address to challenges.cloudflare.com to verify it. Terms: https://www.cloudflare.com/website-terms/ Privacy: https://www.cloudflare.com/privacypolicy/ #### Google reCAPTCHA (optional) Same purpose. When a visitor loads a protected form, their browser loads Google’s script from google.com (or recaptcha.net, if you choose that option), which collects device and browser data. When the form is submitted, your site sends the CAPTCHA token and the visitor’s IP address to Google to verify it. Terms: https://policies. google.com/terms Privacy: https://policies.google.com/privacy #### hCaptcha (optional) Same purpose and data flow, through js.hcaptcha.com and api.hcaptcha.com. Terms: https://www.hcaptcha.com/terms Privacy: https://www.hcaptcha.com/privacy ### Privacy The plugin stores security information to protect accounts: usernames tried, IP addresses and their approximate country (looked up in a database included with the plugin, never online), browser user agents (optional), times, sign-in methods and results, and session activity for the roles you choose to track. Logs are kept for 30 days by default and deleted automatically after the period you set; each log can also be switched off under Settings. A suggested privacy-policy text is added to Settings > Privacy, and the data works with WordPress’s personal data export and erasure tools. Passwords, verification codes, sign-in tokens and secrets are never logged. Codes and tokens are stored only as keyed hashes, and authenticator secrets and provider keys are encrypted. ### Development The plugin’s JavaScript and CSS are shipped unminified. The IP to country data in` data/ip-country.dat` is IP Geolocation by DB-IP (https://db-ip.com), IP to Country Lite, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), converted to a compact lookup format. It is updated with plugin releases. The bundled QR code library is qrcode-generator 1.4.4 by Kazuhiko Arase (MIT license, https://github. com/kazuhikoarase/qrcode-generator), included unminified in `assets/vendor/qrcode- generator/`. ## Screenshots [⌊Overview: your protection score, today's sign-ins and failures, lockouts and the latest security events.⌉⌊Overview: your protection score, today's sign-ins and failures, lockouts and the latest security events.⌉[ Overview: your protection score, today’s sign-ins and failures, lockouts and the latest security events. [⌊Custom login URL: move the login page to your own address; wp-login.php and wp- admin show a "not found" page to visitors.⌉⌊Custom login URL: move the login page to your own address; wp-login.php and wp-admin show a "not found" page to visitors .⌉[ Custom login URL: move the login page to your own address; wp-login.php and wp-admin show a “not found” page to visitors. [⌊Login Protection: active lockouts with the country of each IP, and failed-login limits per IP address and per account.⌉⌊Login Protection: active lockouts with the country of each IP, and failed-login limits per IP address and per account.⌉[ Login Protection: active lockouts with the country of each IP, and failed-login limits per IP address and per account. [⌊People see how many attempts they have left before sign-in is locked.⌉⌊People see how many attempts they have left before sign-in is locked.⌉[ People see how many attempts they have left before sign-in is locked. [⌊A locked visitor sees the lockout as soon as the login page opens.⌉⌊A locked visitor sees the lockout as soon as the login page opens.⌉[ A locked visitor sees the lockout as soon as the login page opens. [⌊Two-factor authentication: authenticator apps, email codes and backup codes, required for the roles you choose.⌉⌊Two-factor authentication: authenticator apps, email codes and backup codes, required for the roles you choose.⌉[ Two-factor authentication: authenticator apps, email codes and backup codes, required for the roles you choose. [⌊CAPTCHA: six options, and a real check of your keys before you save them.⌉⌊CAPTCHA: six options, and a real check of your keys before you save them.⌉[ CAPTCHA: six options, and a real check of your keys before you save them. [⌊Integrations: which login forms are protected, including WooCommerce and other plugins' forms.⌉⌊Integrations: which login forms are protected, including WooCommerce and other plugins' forms.⌉[ Integrations: which login forms are protected, including WooCommerce and other plugins’ forms. [⌊XML-RPC and application passwords: block sign-ins over XML-RPC or turn it off, and limit application passwords to administrators.⌉⌊XML-RPC and application passwords: block sign-ins over XML-RPC or turn it off, and limit application passwords to administrators .⌉[ XML-RPC and application passwords: block sign-ins over XML-RPC or turn it off, and limit application passwords to administrators. [⌊Redirects: where people land after signing in or out, with a summary of what happens now.⌉⌊Redirects: where people land after signing in or out, with a summary of what happens now.⌉[ Redirects: where people land after signing in or out, with a summary of what happens now. [⌊Admin Activity: every change to the security settings, with who made it, the IP address and country.⌉⌊Admin Activity: every change to the security settings, with who made it, the IP address and country.⌉[ Admin Activity: every change to the security settings, with who made it, the IP address and country. [⌊Email notifications for lockouts, new admin IP addresses and settings changes, grouped so attacks never flood your inbox.⌉⌊Email notifications for lockouts, new admin IP addresses and settings changes, grouped so attacks never flood your inbox .⌉[ Email notifications for lockouts, new admin IP addresses and settings changes, grouped so attacks never flood your inbox. [⌊Diagnostics: checks that test your login address and spot conflicts.⌉⌊Diagnostics: checks that test your login address and spot conflicts.⌉[ Diagnostics: checks that test your login address and spot conflicts. [⌊Settings: trusted IP detection, privileged roles, session tracking and what happens to your data on uninstall.⌉⌊Settings: trusted IP detection, privileged roles, session tracking and what happens to your data on uninstall.⌉[ Settings: trusted IP detection, privileged roles, session tracking and what happens to your data on uninstall. ## Installation 1. Install and activate the plugin. Activation does not switch on any restriction, so nobody gets locked out. 2. Go to **Login Security > Login URLs** to choose a custom login address. Open it in a private window to test it before signing out. 3. Go to **Login Security > Authentication** to choose which roles must use two-factor authentication. Each user sets up their own methods on their profile page. 4. Review **Login Protection**, **CAPTCHA** and **IP Rules**. 5. Open **Diagnostics** to check your setup. ## FAQ ### I forgot my custom login URL or locked myself out. What now? Add one of these lines to `wp-config.php`, sign in, fix the setting, then remove the line: * `define( 'WPSMARTO_LS_DISABLE_CUSTOM_LOGIN', true );` restores `wp-login.php`. * `define( 'WPSMARTO_LS_DISABLE_IP_RULES', true );` turns off IP rules. * `define( 'WPSMARTO_LS_DISABLE_CAPTCHA', true );` turns off CAPTCHA. * `define( 'WPSMARTO_LS_DISABLE_2FA', true );` turns off 2FA if email is down. * `define( 'WPSMARTO_LS_DISABLE_LOCKOUTS', true );` turns off failed-login lockouts. * `define( 'WPSMARTO_LS_SAFE_MODE', true );` does all of the above. These switches only relax extra restrictions. A normal WordPress password is still required. With WP-CLI you can also run `wp smarto-ls login-url reset`, `wp smarto- ls ip clear`, `wp smarto-ls lockouts clear` or `wp smarto-ls 2fa reset `. The custom login address is also emailed to the site administrator whenever it changes. ### Does it work with WooCommerce? Yes. The My Account login, registration, lost-password and new-password forms are protected, customers stay on My Account (or a page you choose) after signing in, and checkout is not changed. ### Does it work behind Cloudflare or a reverse proxy? Yes. Under **Settings**, choose the header your proxy sets (for example CF-Connecting- IP) and list the proxy’s IP ranges as trusted. Headers from other sources are ignored, so visitors cannot fake their IP address. ### A user lost their phone. They can sign in with a backup code. An administrator can also reset their two-factor methods from their profile page after confirming who they are. ### Do I need pretty permalinks? The custom login URL needs them. All other features work with any permalink setting. ### Will deleting the plugin remove my data? Only if you turn on “Delete all plugin data when the plugin is deleted” under ** Settings**. Otherwise settings, history and users’ 2FA setup are kept for a reinstall. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Smarto Login Security” is open source software. The following people have contributed to this plugin. Contributors * [ Shahadat ](https://profiles.wordpress.org/sshahadatgsm/) [Translate “Smarto Login Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/smarto-login-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/smarto-login-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/smarto-login-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/smarto-login-security/) by [RSS](https://plugins.trac.wordpress.org/log/smarto-login-security/?limit=100&mode=stop_on_copy&format=rss). ## Meta * Version **1.0.0** * Last updated **14 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.5 or higher ** * Tested up to **7.1.4** * PHP version ** 8.0 or higher ** * Tags * [2FA](https://wordpress.org/plugins/tags/2fa/)[Brute Force](https://wordpress.org/plugins/tags/brute-force/) [custom login url](https://wordpress.org/plugins/tags/custom-login-url/)[login security](https://wordpress.org/plugins/tags/login-security/) [two factor authentication](https://wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://wordpress.org/plugins/smarto-login-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/smarto-login-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/smarto-login-security/reviews/) ## Contributors * [ Shahadat ](https://profiles.wordpress.org/sshahadatgsm/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/smarto-login-security/)