Title: Trivla Account Security Author: trivlasupport Published: October 26, 2026 Last modified: October 26, 2026 --- Search plugins ![](https://ps.w.org/trivla-account-security/assets/banner-772x250.png?rev=3765496) ![](https://ps.w.org/trivla-account-security/assets/icon-256x256.png?rev=3765496) # Trivla Account Security By [trivlasupport](https://profiles.wordpress.org/trivlasupport/) [Download](https://downloads.wordpress.org/plugin/trivla-account-security.2.0.6.zip) * [Details](https://wordpress.org/plugins/trivla-account-security/#description) * [Reviews](https://wordpress.org/plugins/trivla-account-security/#reviews) * [Installation](https://wordpress.org/plugins/trivla-account-security/#installation) * [Development](https://wordpress.org/plugins/trivla-account-security/#developers) [Support](https://wordpress.org/support/plugin/trivla-account-security/) ## Description Trivla Account Security is a small security and housekeeping screen for WordPress and WooCommerce Store administrators. * **Login log** records successful and failed sign-ins, with IP, country, browser, operating system, and device. Search by username, IP, country, or browser, filter by result, and move through pages of 50. * **Automatic log deletion** removes login events, block notes, and cleanup notes older than the number of days you choose. The default is 90 days. You can also delete old events immediately, or clear the login log after ticking a confirmation box. * **Brute-force blocking** blocks an IP after too many failed logins in a short window. Blocked addresses cannot sign up or sign in. You can unblock them from the settings screen. * **Geo-gate & review** holds new registrations from countries that are not on your allowed list. Held accounts have no permissions until you approve them. Rejecting an account can also block its IP. This screen is its own tab. * **WooCommerce customer cleanup**, when WooCommerce is active, lists customers who never ordered or never logged in, with search, paging, and bulk delete. A daily job can delete old matching accounts. That job is off on a new install. Login is not held up by a country lookup. The plugin uses a Cloudflare country header when you enable it, a local cache, or a later scheduled task. The login log stores IP addresses and user agents. Say so in your privacy policy, and keep the retention period as short as you need. Customer tools need WooCommerce. The login log, IP block, and country review work on any WordPress site. ### External services This plugin can connect to ipwho.is (https://ipwho.is) to turn an IP address into a country code. * **When:** only if “Look up countries online” is enabled, and the country is not already known from Cloudflare or the local cache. * **What is sent:** the IP address. The request asks for `success` and `country_code` only. * **Signups:** looked up during registration when the country gate is on, so the plugin can decide whether to hold the account. * **Logins:** not looked up during sign-in. A scheduled task fills the login log later. * **Storage:** a successful code is cached for 30 days. A failed lookup is remembered for 6 hours, then retried. * **Service terms:** https://ipwhois.io/docs Turn the lookup off on the Geo-gate & review tab to stop these requests. With the Cloudflare option enabled, the plugin can use the `CF-IPCountry` header instead. ## Screenshots [⌊Customer list, with search and the scheduled cleanup settings.⌉⌊Customer list, with search and the scheduled cleanup settings.⌉[ Customer list, with search and the scheduled cleanup settings. [⌊Login log, with search, result filter, and retention.⌉⌊Login log, with search, result filter, and retention.⌉[ Login log, with search, result filter, and retention. [⌊Geo-gate, country review queue, and blocked addresses.⌉⌊Geo-gate, country review queue, and blocked addresses.⌉[ Geo-gate, country review queue, and blocked addresses. ## Installation 1. Upload the `trivla-account-security` folder to `/wp-content/plugins/`, or install the zip from Plugins Add New Upload Plugin. 2. Activate Trivla Account Security through the Plugins screen. 3. Open Account Security in the admin menu. If WooCommerce is active, the same screen is also linked under WooCommerce. The old `customer-cleanup` address redirects here. 4. If you were running the earlier single-file plugin, deactivate that copy first so each login is not recorded twice. Your existing login log and settings are kept. ## FAQ ### Does this require WooCommerce? No. Login logging, failed-login blocking, and the country review queue work without WooCommerce. The Customers tab needs WooCommerce. ### Will it delete customers by itself? Not on a new install. Daily deletion stays off until you turn it on under Customers Scheduled auto-delete. A manual “Run cleanup now” button uses the same rules and asks you to confirm. Sites upgrading from version 1.x keep daily deletion turned on, because that version always ran it. ### Which customers can the cleanup delete? Only users with the Customer role, and never your own account or an account that also has an administrator, shop manager, editor, or author role. Choose either “ 0 orders” or the stricter “0 orders, email not verified, and never logged in”, plus a minimum account age. ### How does email verification get detected? The plugin reads a user meta key, `account_verified` by default. Values `1`, `yes`,` true`, `verified`, or `active` count as verified. Anything else present counts as not verified. No meta at all shows as “No record”. Change the key on the Customers tab to match your verification plugin. Developers can use the `trivla_verified_meta_key` and `trivla_customer_verified_state` filters. ### I blocked my own IP. How do I get back in? Sign in from another network and clear the address under Geo-gate & review. The list is the `trivla_blocked_ips` option in the WordPress options table. The Block button refuses the address you are currently using; automatic blocking after failed logins can still block a shared address. ### Why are all the IP addresses the same? WordPress is probably behind Cloudflare or another proxy. On Geo-gate & review, enable “This site is behind Cloudflare” or “Trust X-Forwarded-For / X-Real-IP”. Leave both off if you are not behind a proxy, so visitors cannot forge an address. Upgrades from version 1.x keep the old behavior of trusting those headers. ### What happens to orders when a customer is deleted? The WordPress account is removed. WooCommerce keeps the orders and detaches them from that account. ### Where is the data stored? Login events are in the `{prefix}trivla_login_log` table. Settings, the block list, and short notes are WordPress options whose names start with `trivla_`. Uninstalling the plugin from the Plugins screen deletes the table, those options, the pending role, and the signup/login meta this plugin added. It does not delete user accounts. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Trivla Account Security” is open source software. The following people have contributed to this plugin. Contributors * [ trivlasupport ](https://profiles.wordpress.org/trivlasupport/) [Translate “Trivla Account Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/trivla-account-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/trivla-account-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/trivla-account-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/trivla-account-security/) by [RSS](https://plugins.trac.wordpress.org/log/trivla-account-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.0.6 * Scheduled tasks are cleared during deactivation only after the Plugins screen nonce and the deactivate capability both pass. #### 2.0.5 * Registered names use the trivla_ prefix. Existing logs, settings, and held accounts are copied across on upgrade. * Translations are left to WordPress. * Order and customer queries, and the values read during deactivation, pass the Plugin Check rules. #### 2.0.4 * Admin output is escaped, submitted values are sanitized, and every settings form checks its nonce. #### 2.0.3 * Database queries for the login log, customer lists, and uninstall now pass values through prepare, including table names. #### 2.0.2 * Deactivation finishes even when a scheduled task is due. * On Multisite, a network-activated copy links to Network Deactivate. * Deleting the plugin removes its table, settings, scheduled tasks, and the pending role. #### 2.0.1 * Show the full TRIVLA header. #### 2.0.0 * Rebuilt as a multi-file plugin for the public plugin directory. * Login log has search, a success/failed filter, and paging. * Login events and the short security notes are deleted automatically after a retention period you set. * Geo-gate and account review are on their own tab, with paging for the review queue. * Customer lists are loaded one page at a time instead of reading every customer into memory. * Country lookups no longer run during sign-in. * Scheduled customer deletion is off on new installs and can be switched on from the screen. Version 1.x sites keep it on. * Proxy headers are ignored unless you opt in. Version 1.x sites keep trusting them. #### 1.5 * Single-file release: customer cleanup, login log, geo-gate, and failed-login blocking. ## Meta * Version **2.0.6** * Last updated **5 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [authentication](https://wordpress.org/plugins/tags/authentication/)[login](https://wordpress.org/plugins/tags/login/) [security](https://wordpress.org/plugins/tags/security/)[users](https://wordpress.org/plugins/tags/users/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/trivla-account-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/trivla-account-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/trivla-account-security/reviews/) ## Contributors * [ trivlasupport ](https://profiles.wordpress.org/trivlasupport/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/trivla-account-security/)