Removes our own branding from the emails this plugin sends to your users, and fixes a broken link in the plugin header.<\/p>","1.7.0":"
A settings search and an unsaved-changes save bar. No change to how the protection works \u2014 safe drop-in update.<\/p>","1.6.0":"
Brand-new dashboard in the DadsFam house style, Cloudflare\/proxy support, instant lockout for bot usernames, protection-level presets and a one-click \u201cnever lock me out\u201d. Safe drop-in update \u2014 your settings are kept.<\/p>","1.5.4":"
Warns you when a conflicting login\/2FA plugin is active, and is now translation-ready. Safe drop-in update.<\/p>","1.5.3":"
Adds a database index so dashboard stats stay fast on large logs (applied automatically). Safe drop-in update.<\/p>","1.5.2":"
Activity Log now labels email-link sign-ins from the Pro add-on. Safe drop-in update.<\/p>","1.5.1":"
Activity Log now labels passkey events from the Pro add-on. Safe drop-in update.<\/p>","1.5.0":"
New-sign-in email alerts, CSV export of the activity log, and an audit-events filter. Safe drop-in update.<\/p>","1.4.1":"
Two-factor audit events now appear clearly in the Activity Log. Safe drop-in update.<\/p>","1.4.0":"
Live attack arcs on the threat sphere, gauge pulse rings, panel spotlight and an unblock animation. Safe drop-in update.<\/p>","1.3.0":"
Adds a rotating 3D threat sphere, decode number animations, a chart scan line and an aurora backdrop. Safe drop-in update.<\/p>","1.2.0":"
A live security-console dashboard with gauge, radar, activity ticker, dark mode and optional alert sound. Safe drop-in update.<\/p>","1.1.0":"
Live auto-refreshing dashboard and a full premium UI refresh. Safe drop-in update.<\/p>","1.0.0":"
First release of DadsFam Login Security.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3697870,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3697870,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3697870,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3697870,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.7.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3697870,"resolution":"1","location":"assets","locale":"","width":1280,"height":1600},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3697870,"resolution":"2","location":"assets","locale":"","width":1280,"height":1296},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3697870,"resolution":"3","location":"assets","locale":"","width":1280,"height":1600}},"screenshots":{"1":"The dashboard: protection status in one sentence, a finish-locking-down checklist, live stats, the 14-day chart and who is locked out right now.","2":"Activity: every sign-in attempt, filtered with one click, with \u201cBlock for good\u201d on any row.","3":"Settings: pick Relaxed, Balanced or Strict, flip plain-English switches, and put your own address on the allow list with one click."}},"plugin_section":[262246],"plugin_tags":[2439,9374,13868,602,600],"plugin_category":[38,54],"plugin_contributors":[274194],"plugin_business_model":[],"class_list":["post-367859","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-brute-force","plugin_tags-limit-login-attempts","plugin_tags-lockout","plugin_tags-login","plugin_tags-security","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-dadsfam","plugin_committers-dadsfam"],"banners":{"banner":"https:\/\/ps.w.org\/dadsfam-login-security\/assets\/banner-772x250.png?rev=3697870","banner_2x":"https:\/\/ps.w.org\/dadsfam-login-security\/assets\/banner-1544x500.png?rev=3697870","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/dadsfam-login-security\/assets\/icon-128x128.png?rev=3697870","icon_2x":"https:\/\/ps.w.org\/dadsfam-login-security\/assets\/icon-256x256.png?rev=3697870","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/dadsfam-login-security\/assets\/screenshot-1.png?rev=3697870","caption":"The dashboard: protection status in one sentence, a finish-locking-down checklist, live stats, the 14-day chart and who is locked out right now."},{"src":"https:\/\/ps.w.org\/dadsfam-login-security\/assets\/screenshot-2.png?rev=3697870","caption":"Activity: every sign-in attempt, filtered with one click, with \u201cBlock for good\u201d on any row."},{"src":"https:\/\/ps.w.org\/dadsfam-login-security\/assets\/screenshot-3.png?rev=3697870","caption":"Settings: pick Relaxed, Balanced or Strict, flip plain-English switches, and put your own address on the allow list with one click."}],"raw_content":"\n
DadsFam Login Security<\/strong> protects the most-attacked part of your WordPress site \u2014 the login form \u2014 without making you read a manual or fiddle with servers.<\/p>\n\n Everything described below works on every site. Nothing is disabled, blurred out, time-limited or reduced.<\/p>\n\n It watches failed logins, locks out attackers automatically, escalates repeat offenders to a longer ban, and keeps a clean log of everything so you can see exactly what's hitting your site.<\/p>\n\n The optional DadsFam Login Security Pro<\/strong> add-on plugs into the same screens and adds two-factor authentication (authenticator apps and email codes, with backup codes and trusted devices), CAPTCHA on the login form (Google reCAPTCHA, hCaptcha, Cloudflare Turnstile or a built-in maths question), a custom hidden login address, a branded login screen, strong-password and breached-password checks, idle auto-logout, scheduled security reports, and country blocking.<\/p>\n\n Right, let me be straight with you, because I hate being sold to as much as you do.<\/p>\n\n Everything above is free and it stays free. The lockouts, the allow and deny lists, the activity log, the live dashboard, the email alerts, the bot traps and the hardening \u2014 none of those are premium features. Those are the things a login-security plugin should just do, and if I put them behind a paywall I would be taking the mickey.<\/p>\n\n There is a PRO add-on. It exists because I am a dad in Cape Town, and this is one of the things that puts food on the table at my house. That is the honest reason. Not \"unlock your potential\", not \"supercharge your workflow\". Just: if this plugin kept the bots off your login page and you can spare it, PRO helps me keep building.<\/p>\n\n What PRO adds is the second layer you reach for once the door is already locked \u2014 two-factor codes, a CAPTCHA, a hidden login address, breached-password checks, country blocking. That is extra security and convenience. It is not the plugin working properly, because the plugin already works properly.<\/p>\n\n So if the free one does everything you need, brilliant. Genuinely. Use it, and I hope your activity log stays boring. If you get to the point where a second factor or a hidden login would let you sleep better, PRO is at plugins.dadsfam.co.za.<\/p>\n\n Either way, thanks for using something I built. \u2014 Zak, DadsFam<\/p>\n\n\n It locks out by IP after repeated failed<\/em> logins. Add your own IP to the Allow list<\/strong> under Settings to be safe. If you ever get stuck, lockouts expire on their own, or you can clear the By default it uses the real connection IP ( Yes \u2014 the honeypot and protection also apply to the WooCommerce login form.<\/p><\/dd>\n Disabling just pingbacks<\/strong> is safe for nearly everyone. Disabling XML-RPC completely<\/strong> can affect the WordPress\/Jetpack mobile app and some remote-publishing tools, so that option is off by default.<\/p><\/dd>\n\n<\/dl>\n\n\nWhat you get (free)<\/h4>\n\n
\n
1.2.3.*<\/code>) and CIDR ranges (1.2.3.0\/24<\/code>). IPv4 and IPv6.<\/li>\n?author=N<\/code> and the REST API), kill XML-RPC pingback amplification, or disable XML-RPC entirely.<\/li>\n<\/ul>\n\nPro Features (DadsFam Login Security Pro add-on)<\/h4>\n\n
A word about PRO<\/h4>\n\n
\n
\/wp-content\/plugins\/<\/code>, or install the ZIP via Plugins \u2192 Add New \u2192 Upload Plugin<\/strong>.<\/li>\n\n
Will this lock me out of my own site?<\/h3><\/dt>\n
wp_dfls_lockouts<\/code> database table.<\/p><\/dd>\nDoes it work behind Cloudflare or a load balancer?<\/h3><\/dt>\n
REMOTE_ADDR<\/code>), which can't be spoofed. If you're behind a trusted proxy, you can return the forwarded header using the dfls_client_ip<\/code> filter.<\/p><\/dd>\nIs it compatible with WooCommerce login forms?<\/h3><\/dt>\n
Will disabling XML-RPC break anything?<\/h3><\/dt>\n
1.7.1<\/h4>\n\n
\n
1.7.0<\/h4>\n\n
\n
1.6.1<\/h4>\n\n
\n
1.6.0<\/h4>\n\n
\n
define( 'DFLS_DISABLE_LOCKOUTS', true );<\/code> to wp-config.php and every lockout is switched off until you remove it. The dashboard shows a red warning while it is in place.<\/li>\n1.5.5<\/h4>\n\n
\n
1.5.4<\/h4>\n\n
\n
1.5.3<\/h4>\n\n
\n
1.5.2<\/h4>\n\n
\n
1.5.1<\/h4>\n\n
\n
1.5.0<\/h4>\n\n
\n
1.4.1<\/h4>\n\n
\n
1.4.0<\/h4>\n\n
\n
1.3.0<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n
1.1.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n