Description
Takumi Private Gate turns a WordPress install into a fully private site: nothing is reachable without logging in first. It’s built for people running a diary, notes site, or internal tool on WordPress that should never be publicly visible or crawlable.
Unlike most “force login” or “password protect” plugins, Takumi Private Gate combines four protections in a single, dependency-free plugin:
- Site-wide lockdown: every page, post, and feed redirects unauthenticated visitors to the standard WordPress login screen.
- REST API blocking: unauthenticated requests to
/wp-json/receive a401 Unauthorizedresponse. - XML-RPC disabled:
/xmlrpc.phpis fully disabled for everyone, authenticated or not. - Failed-login lockout: an IP address is locked out for a configurable amount of time after too many failed login attempts, and by default the plugin says nothing that would tell an attacker they’re locked out.
Developed and maintained by Yoshiro Moriyama, founder of Takumi Web Services, a WordPress development studio based in Toronto, Canada.
Features
- Redirects every unauthenticated front-end request to
wp-login.php. - Returns
401 Unauthorizedfor unauthenticated REST API requests. - Disables XML-RPC entirely.
- Locks out an IP address after a configurable number of failed login attempts (default: 5 attempts / 30 minutes).
- Lockout state is stored per IP address, not per username.
- Lists every currently locked-out IP with a one-click unlock button.
- Keeps a rolling log (most recent 1000 attempts) of login attempts with date, IP, username, and result.
- Emails the site admin address whenever an IP gets locked out (can be turned off).
- IP whitelist (single IPs or CIDR ranges) that bypasses the lockdown, the API blocking, and the lockout entirely.
- Optional per-user TOTP two-factor authentication (compatible with Google Authenticator, Authy, 1Password, etc.) enrolled from each user’s own profile screen.
- Network-activation aware: sets up per-site defaults and its login-log table on every site of a multisite network.
- Single settings screen under Settings > Private Gate.
- Uninstalling the plugin removes its options, its login-log table, and any 2FA secrets.
Screenshots
Installation
- Upload the
takumi-private-gatefolder to/wp-content/plugins/, or install it directly from the Plugins screen. - Activate the plugin through the “Plugins” screen in WordPress.
- Go to Settings > Private Gate to adjust the failed-login threshold and lockout duration.
FAQ
-
Will this lock me out of my own site?
-
Only if you fail to log in more times than the configured threshold (5 by default).
wp-login.phpitself is never blocked, since it’s the only way to authenticate. -
Does this block search engines and RSS readers too?
-
Yes. Since the entire site requires authentication, no unauthenticated client (including search engine crawlers and feed readers) can access any content.
-
Why doesn’t the login form say I’m locked out?
-
By default, Takumi Private Gate intentionally shows a generic “incorrect username or password” message instead of revealing that the IP is locked out. This keeps an attacker running a brute-force attempt from learning that their requests are being blocked outright. This can be changed in Settings > Private Gate.
-
Will I get emailed every time someone fails to log in?
-
No. An email is only sent when an IP actually crosses the failed-attempt threshold and gets locked out, not on every failed attempt. This can be turned off in Settings > Private Gate.
-
Does the login log grow forever?
-
No. Only the most recent 1000 login attempts are kept; older entries are pruned automatically.
-
Can I make sure I never get locked out?
-
Yes. Add your own IP address (or a CIDR range covering it) to the whitelist in Settings > Private Gate. Whitelisted IPs bypass the site-wide lockdown, the REST API/XML-RPC blocking, and the failed-login lockout.
-
How do I set up two-factor authentication?
-
Go to your own Users > Profile screen, find the “Takumi Private Gate: Two-Factor Authentication (2FA)” section, add the displayed key to an authenticator app, and enter the 6-digit code it shows to confirm. No QR code is generated by the plugin, since that would mean sending your secret to a third-party image service; the manual-entry key works with every authenticator app.
-
Does this work on a multisite network?
-
Yes. If you network-activate the plugin, each site gets its own settings and login-log table, including sites created after activation. Two-factor authentication is tied to the user account and applies network-wide.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Takumi Private Gate” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Takumi Private Gate” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.2
- Removed bundled .po/.mo translation files; translations are now handled via translate.wordpress.org.
1.2.1
- Internationalized the plugin: source strings are now in English with a bundled Japanese (ja) translation.
- Unique-prefixed the admin asset handles to avoid conflicts with other plugins.
1.2.0
- Added an IP whitelist (single IPs or CIDR ranges) that bypasses the lockdown, API blocking, and lockout.
- Added optional per-user TOTP two-factor authentication, enrolled from the user’s own profile screen.
- Added proper multisite network-activation support (per-site setup on activation and on new site creation).
1.1.0
- Added a list of currently locked-out IPs with a manual unlock button.
- Added a login attempt log (date, IP, username, result), capped at the most recent 1000 entries.
- Added an email notification to the site admin address when an IP is locked out.
1.0.0
- Initial release: site-wide lockdown, REST API blocking, XML-RPC disabling, and failed-login lockout.