Loginizer is a WordPress plugin for limiting repeated login failures and managing IP access. Loginizer-Security Pro adds more ways to verify visitors, adjust login paths and review core documents. Administrators can choose which controls to use in the WordPress administration area.

Control failed attempts and IP access

By default, Loginizer blocks an IP address for 15 minutes after three failed login attempts. After multiple lockouts, the block lasts 24 hours. Administrators can change these settings on the brute-force page.

• Review failed-login logs and blacklist or whitelist IP addresses and ranges.
• Restrict login to trusted IP addresses or show a blocked screen in place of the login page.
• Customize failed-login messages and receive email notifications after successful logins.
• Check permissions for important files and folders, and let users sign in with LinkedIn.

Choose how users verify their account

Pro offers passwordless login, which asks for a username or email address and sends a temporary login link to that account's email. Email-based two-factor authentication sends a temporary six-digit code after the user enters their login details. Users can also set up app-based two-factor authentication with an app such as Google Authenticator or Authy.

Passkeys provide another login option. Users can also set a challenge question and answer, which they must provide after login to complete access. Pro Social Login works with Google, GitHub, Facebook, X, Discord, Twitch, LinkedIn and Microsoft, with WooCommerce and Ultimate Member support. A keyless social login setup is available for supported providers.

Configure CAPTCHA and login paths

CAPTCHA settings include Google reCAPTCHA v2 or v3, Cloudflare Turnstile and hCAPTCHA. Administrators can configure them for the login screen, comments and registration forms. WooCommerce is supported for account and registration processes, along with Contact Form 7 and WPForms.

Pro can change the login page slug from wp-login.php and rename the administration path from wp-admin to a custom value. With Rename Login with Secrecy, login links continue to point to wp-login.php, so users must enter the new slug directly in their browser. CSRF Protection adds a session string to the administration URL, making it harder to predict.

Additional access controls and file checks

Other Pro controls include disabling or renaming XML-RPC, disabling pingbacks, changing the administrator username, blocking new registrations from specified domains and automatically blacklisting IP addresses when specified usernames are used. Administrators can also block IP addresses from selected countries and limit how many devices can be logged into an account at once. User enumeration protection blocks unauthenticated access to common username lists and paths. Single Sign-On can provide temporary dashboard access without sharing a username or password.

Loginizer's file-permission checks cover important files and folders. Pro's MD5 Checksum checks WordPress core files; administrators can review the results and ignore files when appropriate.

Set up the controls

1. Install and activate Loginizer-Security Pro in WordPress.
2. Open the Loginizer settings and review brute-force options, logs and IP rules.
3. Choose passwordless login, email or app-based two-factor authentication, passkeys or a challenge question.
4. Configure CAPTCHA, WooCommerce-related protection and custom login or administration URLs as needed.
5. Run the core-file checksum check and review any files that need attention.

Loginizer-Security Pro includes professional support through the Premium Support Ticket System. Documentation is available for Loginizer, and free users can use the community support forums.