Only matters if you installed this plugin from a zip before: two active copies\nno longer collide, and the screen tells you which one to deactivate.<\/p>","6.1.0":"
Security release. The attempt slowdown and the anti-bot challenge were refusing\nnothing at all, and three requests could make the site hand out your hidden\nlogin address. Update.<\/p>","6.0.3":"
Housekeeping release: the version constant had drifted two releases behind, so\nbrowsers kept serving the old stylesheets. Nothing to do on your side.<\/p>","6.0.0":"
Security release: two ways around two-step verification and three around the\nhidden login address are closed. Some features moved to Loginly Pro, a separate\nplugin \u2014 what stays free stays free, and nothing you run today switches off.<\/p>","5.0.0":"
The interface is now English by default, with French shipped as a translation.\nNothing else changes; your settings are untouched.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3692189,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3692189,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3692189,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3692189,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":{"loginly\/login":{"$schema":"https:\/\/schemas.wp.org\/trunk\/block.json","apiVersion":3,"name":"loginly\/login","title":"Login","category":"widgets","icon":"unlock","description":"A login form that follows the styling of your login page.","textdomain":"digitsummit-loginly","supports":{"html":false,"align":["wide","full"],"spacing":{"margin":true,"padding":true}},"attributes":{"title":{"type":"string","default":""},"showRememberMe":{"type":"boolean","default":true},"rememberChecked":{"type":"boolean","default":false},"showLostPassword":{"type":"boolean","default":true},"showRegister":{"type":"boolean","default":false},"redirectTo":{"type":"string","default":""},"loggedInText":{"type":"string","default":""}},"editorScript":"loginly-block-editor","style":"loginly-block"}},"tagged_versions":["6.1.0","6.1.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3692189,"resolution":"1","location":"assets","locale":"","width":1200,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3692189,"resolution":"2","location":"assets","locale":"","width":1200,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3692189,"resolution":"3","location":"assets","locale":"","width":1200,"height":900},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3692189,"resolution":"4","location":"assets","locale":"","width":1200,"height":900},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3692189,"resolution":"5","location":"assets","locale":"","width":1200,"height":900}},"screenshots":{"1":"The editor, with the live preview of the login page.","2":"Settings: activation, exposure report, login address, door status.","3":"The exposure report: what a stranger actually gets from your site.","4":"A branded login screen \u2014 the visitor's side of the plugin.","5":"The access log: who signed in, when, and from where."}},"plugin_section":[],"plugin_tags":[3691,25642,602,1229,9217],"plugin_category":[38],"plugin_contributors":[280315],"plugin_business_model":[],"class_list":["post-364448","plugin","type-plugin","status-publish","hentry","plugin_tags-custom-login","plugin_tags-hide-login","plugin_tags-login","plugin_tags-login-security","plugin_tags-two-factor","plugin_category-authentication","plugin_contributors-digitsummit","plugin_committers-digitsummit"],"banners":{"banner":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/banner-772x250.png?rev=3692189","banner_2x":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/banner-1544x500.png?rev=3692189","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/icon-128x128.png?rev=3692189","icon_2x":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/icon-256x256.png?rev=3692189","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/screenshot-1.png?rev=3692189","caption":"The editor, with the live preview of the login page."},{"src":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/screenshot-2.png?rev=3692189","caption":"Settings: activation, exposure report, login address, door status."},{"src":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/screenshot-3.png?rev=3692189","caption":"The exposure report: what a stranger actually gets from your site."},{"src":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/screenshot-4.png?rev=3692189","caption":"A branded login screen \u2014 the visitor's side of the plugin."},{"src":"https:\/\/ps.w.org\/digitsummit-loginly\/assets\/screenshot-5.png?rev=3692189","caption":"The access log: who signed in, when, and from where."}],"raw_content":"\n
DigitSummit Loginly takes care of the whole front door of your WordPress site: how it looks,\nwhere it lives, what protects it, and how you get back in when something goes\nwrong.<\/p>\n\n
Everything is edited from one screen with a live preview. No Customizer, so it\nworks the same on classic and block themes.<\/p>\n\n
Serve the login page from It will not lock you out.<\/strong> After you apply a new address, the server calls it\nback like a logged-out visitor and checks that the form really appears \u2014 and\nthat the old address really stopped answering. If the check fails, the previous\nsetting is restored automatically. An hourly watch repeats that check: after\nthree consecutive failures, An exposure report queries your own site from the server, without being logged\nin, and tells you what a stranger actually gets: the account list through the\nREST API, the The report also states plainly what moving the login page does not<\/em> do. It is\nnot a lock. The lock is:<\/p>\n\n An access log with anonymised IP addresses: who came in, from where, with what\noutcome. Seven days by default \u2014 enough to understand what just happened \u2014 and\nup to a year if an audit asks for it.<\/p>\n\n Loginly Pro is a separate plugin. Nothing here is switched off waiting for a\npayment: the code of these features is not in this plugin at all.<\/p>\n\n One styling published once and fetched by every site under the same licence \u2014\nthe login address, the recovery key and the secrets of each site never travel.\nSign-in hours and approved addresses by role, a session length of your own,\npasswords checked against known breaches when they are chosen \u2014 the password\nnever leaves your server, only five characters of its fingerprint do. An\nanti-bot shield that asks nothing of your visitors and shows them to nobody:\nthe server sets a puzzle only solvable by trying, which a browser answers in a\nfraction of a second and a password-guessing program has to answer on every\nsingle attempt. An email the moment someone signs in from an origin never seen\non this site, a\nweekly summary, every event forwarded to Slack or your own endpoint with a\nsignature, and the log exported as CSV for an audit. Passkeys (Face ID, Touch\nID, Windows Hello, security keys), sign-in links sent by email, nine more\ntemplates, redirects by role or by user, the same styling on\nthe WooCommerce \"My account\" page and in the authentication emails, passkeys and\none-time sign-in links, leaked-password checking, sign-in hours and approved\naddresses by role, carrying a configuration from one site to the next, temporary\naccess links, connected-device limits, network-wide styling for multisite, and\nadmin white labelling.<\/p>\n\n No analytics, no telemetry, no phone-home. Two-step verification runs entirely\non your own server. The full list of what can be contacted, and when, is in the\n\"External services\" section below.<\/p>\n\n The admin interface is written in JSX and bundled with esbuild. Both the sources\nand the bundle ship inside the plugin: To rebuild it from the sources shipped here:<\/p>\n\n The build script is Bundled third-party resources: Inter and JetBrains Mono (Latin subset, variable\nweight), under the SIL Open Font License 1.1 \u2014 full text in\n assets\/fonts\/LICENSE.txt. They are served from your own site: no request ever\nleaves the browser to fetch them.<\/p>\n\n Loginly makes no external request unless you enable a feature that needs one, or\nuntil you press play on the introduction video. Here is exactly what is\ncontacted, and when:<\/p>\n\n That is the whole list for this plugin. It sends no analytics and no telemetry,\nchecks no licence server, and two-step verification runs entirely on your own\nserver. The anti-lockout check and the exposure report do make HTTP requests,\nbut only to your own site's address, from your own server: no third party is\ninvolved.<\/p>\n\n\n To move your login address: open the \"Login address\" panel, note the recovery\naddress it shows you, then apply your address. Test it in a private window\nbefore logging out.<\/strong> The plugin checks it for you as well.<\/p>\n\n\n That is the risk the plugin is built around. Four safety nets, in order: the\nserver verifies any new address and rolls back a failing one; an hourly watch\nrestores It removes the automated noise, and that is all \u2014 the plugin says so in its own\nexposure report. A visitor who obtains the new address reaches the same form.\nReal protection comes from strong passwords, a second factor, attempt slowdown\nand few administrator accounts. Loginly provides those too.<\/p><\/dd>\n Yes. The login page is marked \"do not cache\" on every request, and the address\nis added to the exclusion lists of LiteSpeed Cache, WP Rocket and Cache Enabler\nthrough their own public filters. No third-party plugin's settings are ever\nmodified.<\/strong> A cache placed in front of WordPress (CDN, host) cannot receive\nthose instructions: the diagnostics screen detects it and says so.<\/p><\/dd>\n Loginly detects WPS Hide Login and the equivalent option in Really Simple\nSecurity, and refuses to enable its own. Two guards fighting over one address is\na lockout waiting to happen.<\/p><\/dd>\n\n<\/dl>\n\n\nexample.com\/your-address\/<\/code> and make \/wp-login.php<\/code>\nanswer 404. This removes the automated background noise that hits every\nWordPress site around the clock.<\/p>\n\n\/wp-login.php<\/code> comes back and you are emailed. On\ntop of that: a recovery address, a wp-config.php<\/code> constant, and a\n wp loginly unlock command.<\/p>\n\nSecurity that is honest about itself<\/h4>\n\n
?author=1<\/code> probe, the author sitemap. Most findings have a button\nthat closes them on the spot.<\/p>\n\n\n
What you keep a trace of<\/h4>\n\n
What Loginly Pro adds<\/h4>\n\n
Does it call anyone?<\/h4>\n\n
Source code and build<\/h3>\n\n
assets\/admin\/<\/code> and assets\/block\/<\/code> hold\nthe readable source, build\/<\/code> holds what WordPress loads.<\/p>\n\nnpm install && npm run build\n<\/code><\/pre>\n\nbuild.mjs<\/code> at the plugin root \u2014 a hundred lines, one\nesbuild call, no code generation. It bundles assets\/admin\/index.jsx<\/code> and\n assets\/block\/index.jsx and minifies the result, which is what build\/<\/code>\ncontains. Nothing in build\/<\/code> comes from anywhere else, and rebuilding from the\nsources shipped here reproduces it.<\/p>\n\nExternal services<\/h3>\n\n
\n
challenges.cloudflare.com<\/code>, and your\nserver sends the challenge token, your secret key and the visitor IP address\nto challenges.cloudflare.com\/turnstile\/v0\/siteverify<\/code>.\nTerms<\/a> \u2014\nPrivacy<\/a><\/li>\njs.hcaptcha.com<\/code>,\nverification against hcaptcha.com\/siteverify<\/code>.\nTerms<\/a> \u2014\nPrivacy<\/a><\/li>\n<\/ul>\n\n\n
\n
Can this lock me out of my own site?<\/h3><\/dt>\n
\/wp-login.php<\/code> after three failed checks and emails you; a recovery\naddress opens the login page even if you forget the secret one; and\n define( 'LOGINLY_URL_DISABLE', true ); in wp-config.php<\/code> restores the\noriginal address immediately. Deactivating the plugin also restores it.<\/p><\/dd>\nDoes hiding the login URL actually protect anything?<\/h3><\/dt>\n
Does it work with a caching plugin?<\/h3><\/dt>\n
I already use another plugin that hides the login page<\/h3><\/dt>\n
6.1.1<\/h4>\n\n
\n
loginly\/<\/code> folder before it\nreached this directory as digitsummit-loginly\/<\/code>. A site upgrading has both\non disk, and activating the new one without deactivating the old gave PHP\nwarnings on every request, two identical menus, and two guards fighting over\nthe login address. The copy loaded second now declares nothing and says so,\nand the one that runs points at the other from the Plugins screen. Settings,\nlogin address and access log are untouched either way.<\/li>\n<\/ul>\n\n6.1.0<\/h4>\n\n
\n
authenticate<\/code> below priority 20, where WordPress discards whatever it\nis handed and re-checks the password itself. Six failures in a row went\nunslowed, and the right password opened a session in the middle of a\nten-minute lockout. Measured, fixed, and measured again.<\/li>\nwp-login.php<\/code> in its query string,\n wp-signup.php, and the postpass<\/code> redirect. The address is now rewritten\nonly when the URL path really is the login form.<\/li>\n?loginly=off<\/code>, the escape hatch for a broken theme, also switched off\nthe neutral error message \u2014 handing an attacker \"this account does not exist\".<\/li>\n6.0.3<\/h4>\n\n
\n
6.0.2<\/h4>\n\n
\n
6.0.1<\/h4>\n\n
\n
6.0.0<\/h4>\n\n
\n
loginly_routes<\/code>,\n loginly_cron_tasks, loginly_cron_wanted<\/code>, loginly_imposed_settings<\/code> and\n loginly_settings_locked.<\/li>\n<\/ul>\n\n5.1.0<\/h4>\n\n
\n
5.0.1<\/h4>\n\n
\n
5.0.0<\/h4>\n\n
\n
4.3.0<\/h4>\n\n
\n
4.2.0<\/h4>\n\n
\n
4.1.0<\/h4>\n\n
\n
4.0.0<\/h4>\n\n
\n
3.2.0<\/h4>\n\n
\n
3.1.0<\/h4>\n\n
\n
3.0.0<\/h4>\n\n
\n
2.0.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n