Bots guess usernames like \"admin\" and \"administrator\". On most sites those names don't exist, so any attempt with them is a bot. Phantom User Lockout records each one and blocks the IP address that made it.<\/p>\n\n
For every attempt with a username that doesn't exist on your site, you get:<\/p>\n\n
define( 'BOTLO_DISABLE', true );<\/code> to wp-config.php.<\/li>\n<\/ul>\n\nThe plugin never edits .htaccess or any other server file.<\/p>\n\n
External services<\/h3>\n\n
To show where an IP address is and who owns its network, the plugin looks the address up with ipinfo.io<\/strong>.<\/p>\n\n\n- What is sent:<\/strong> only the IP address that made the login attempt, plus your ipinfo.io token if you entered one in Settings. No information about your site, your users or your visitors is sent.<\/li>\n
- When:<\/strong> once per new IP address, in the background shortly after its first attempt, or when an administrator opens the Phantom User Lockout screen while a lookup is still pending.<\/li>\n
- Turning it off:<\/strong> Settings \u2192 Location lookups.<\/li>\n
- ipinfo.io terms of service: https:\/\/ipinfo.io\/terms-of-service<\/li>\n
- ipinfo.io privacy policy: https:\/\/ipinfo.io\/privacy-policy<\/li>\n<\/ul>\n\n
Privacy<\/h3>\n\n
The plugin stores IP addresses, user agents, usernames and passwords from failed login attempts that used usernames which don't exist. It adds suggested wording to Settings \u2192 Privacy \u2192 Policy Guide.<\/p>\n\n\n
\n- Upload the plugin through Plugins \u2192 Add New \u2192 Upload Plugin, or install it from the directory.<\/li>\n
- Activate it.<\/li>\n
- Open Phantom User Lockout<\/strong> in the admin menu, go to Blocked & Safe IPs<\/strong> and click Add my current IP address to the list<\/strong>. Do the same from every place you or your staff log in.<\/li>\n
- If your site is behind a proxy or CDN and every visitor shows the same IP, change Visitor IP comes from<\/strong> in Settings.<\/li>\n<\/ol>\n\n\n
\nI locked myself out.<\/h3><\/dt>\nAdd define( 'BOTLO_DISABLE', true );<\/code> to wp-config.php, or rename the plugin's folder over FTP. Then log in, unblock your IP, add it to Safe IPs, and remove the line.<\/p><\/dd>\nWhy record the password?<\/h3><\/dt>\nIt shows you which password lists are being used against your site. It's only recorded for usernames that don't exist, so it never belongs to a real account. You can turn it off under Settings \u2192 Passwords.<\/p><\/dd>\n
Does it replace a lockout plugin like Limit Login Attempts?<\/h3><\/dt>\nIt can run next to one. Those plugins lock an IP out for a while after failed logins. Phantom User Lockout records what was tried and blocks the IP permanently.<\/p><\/dd>\n
Can it block the whole site, not just the login page?<\/h3><\/dt>\nYes: Settings \u2192 \"A blocked IP cannot reach\". Pages served from a caching plugin's disk cache never reach WordPress, so those can't be covered.<\/p><\/dd>\n
Where is the data kept?<\/h3><\/dt>\nIn two database tables of the plugin's own. Attempt rows are removed after 180 days or 100,000 rows, whichever comes first, and you can change both limits. Blocked IPs are kept until you unblock them. Deactivating the plugin keeps everything. Deleting the plugin removes the tables and the settings.<\/p><\/dd>\n
Where do I get help?<\/h3><\/dt>\nPost in the plugin's support forum at https:\/\/wordpress.org\/support\/plugin\/phantom-user-lockout\/. Include your WordPress and PHP versions, and what you see in the Attempts log. Don't post passwords or your own IP address there, because the forum is public.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.2.0<\/h4>\n\n\n- Renamed from Login Lockout to Phantom User Lockout.<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n\n- First public release.<\/li>\n
- Records login attempts with usernames that don't exist, including the password tried, the IP's location and its hosting company.<\/li>\n
- Permanent IP blocks, lifted only by Unblock.<\/li>\n
- Safe IPs, with a one-click \"Add my current IP address to the list\".<\/li>\n
- Optional blocking after wrong passwords for real accounts (default 3).<\/li>\n
- Option to stop recording passwords.<\/li>\n
- CSV export.<\/li>\n<\/ul>","raw_excerpt":"Records logins that use usernames which don't exist (username, password tried, IP, location, host) and blocks the IP until you unblock it.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/376066","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=376066"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/efraing"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=376066"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=376066"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=376066"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=376066"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=376066"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=376066"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}