Title: Techbox Login Security – Limit Login Attempts, Brute Force & Secure Login Author: techboxdesign Published: July 15, 2026 Last modified: August 14, 2026 --- Search plugins ![](https://ps.w.org/techbox-login-security/assets/banner-772x250.png?rev=3614975) ![](https://ps.w.org/techbox-login-security/assets/icon-256x256.gif?rev=3614975) # Techbox Login Security – Limit Login Attempts, Brute Force & Secure Login By [techboxdesign](https://profiles.wordpress.org/techboxdesign/) [Download](https://downloads.wordpress.org/plugin/techbox-login-security.1.4.1.zip) * [Details](https://test.wordpress.org/plugins/techbox-login-security/#description) * [Reviews](https://test.wordpress.org/plugins/techbox-login-security/#reviews) * [Installation](https://test.wordpress.org/plugins/techbox-login-security/#installation) * [Development](https://test.wordpress.org/plugins/techbox-login-security/#developers) [Support](https://wordpress.org/support/plugin/techbox-login-security/) ## Description **Your WordPress login page never stops getting knocked on.** Around the clock, automated bots and scripts pound `wp-login.php` with endless username and password guesses. Most of it is background noise — but it drains your server resources, clutters your logs, and quietly probes for a weak spot. Techbox Login Security shuts down that noise and, just as importantly, shows you exactly who is trying to get into your site. The moment you activate it, Techbox Login Security **limits login attempts**, locks out repeat offenders, blocks bad IP addresses, and records every sign-in attempt— so you can see who is knocking, stop the ones that should not be there, and keep your login page fast and quiet. No coding and no security expertise required. #### Why keep an eye on your login? Relentless brute-force and bot traffic is usually more of a constant nuisance than an instant break-in — it hammers your server, inflates your logs, and tests for weak passwords day and night. The real risk is not knowing what is happening at your login. When a site does get compromised, the tell-tale sign is often a **brand- new user account or an unfamiliar login from a strange IP address**. Techbox Login Security cuts the day-to-day noise _and_ keeps a clear record of every attempt — so you can block repeat offenders and catch anything unusual before it becomes a problem. #### Built for real people, not just developers Security software is often written for experts and leaves everyone else guessing. Techbox Login Security is different. It ships with smart defaults, uses plain-English settings, and clearly shows you what is happening at your login — so a first-time site owner and a seasoned agency both feel at home. No confusing jargon, no risky knobs you are afraid to touch, and a one-click way back to a safe baseline whenever you need it. #### What you get (free) * **Limit login attempts & brute-force protection** — set how many tries are allowed before an attacker is locked out, with automatic longer lockouts for repeat offenders. * **Block & allow specific IPs** — instantly block known-bad IP addresses, and allow-list your own office or VPN so you are never locked out. One-click “add my IP.” * **See exactly who tried to log in** — a clear activity log and dashboard record every failed and successful sign-in, when it happened, and the IP behind it, plus your top attacking IPs at a glance, so an unfamiliar login never goes unnoticed. * **Custom login URL** — hide `wp-login.php` behind your own secret address so bots cannot even find your login page. * **Login lockdown** — temporarily pause all new sign-ins during an attack while your site stays online, with bypass for admins and trusted IPs. * **Email login codes** — add an optional one-time code sent by email after the correct password, for an extra layer of protection (role-based, and off until you turn it on). * **Active sessions** — see who is signed in right now (handy both for security and for knowing who is actively using your site) and instantly kick any session you do not recognize. * **Lockout email alerts** — get notified when your site is under attack and users are being locked out. * **XML-RPC & REST control** — close the other doors bots use to attack your login, not just the main form. * **Custom messages & privacy notices** — friendly, customizable login messages plus optional GDPR / privacy notices. * **Proxy & CDN ready** — works correctly behind Cloudflare, Nginx, and other proxies so the real visitor IP is always used. #### More than security — see who actually uses your site Login protection usually stops at failed attempts and lockouts. Techbox Login Security also logs **successful sign-ins — included free** — so you can see which users and customers really log in, how often, and from which IP. For a membership site, online shop, or client portal, that is genuinely useful business insight, not just security: spot your most active members, notice a quiet account that suddenly springs back to life, or simply confirm that a customer got in. The **Active sessions** screen goes further, showing who is signed in right now — a quick read on real engagement and an easy way to manage or end sessions at a glance. (Pro adds the signed-in user’s role to each successful sign-in for even richer insight.) #### Recommended defaults On a fresh install Techbox Login Security applies a sensible “out of the box” posture so the site is protected immediately: login limits on (5 attempts / 15-minute lockout/ 24-hour failure decay, escalating to a 24-hour lockout after repeat strikes), failed and successful logins logged, attempt feedback and the footer privacy notice on. Optional features (custom login URL, lockout emails, email login codes, login lockdown) stay off until you configure them. Every settings section has a **Restore recommended** action. #### Upgrade to Pro Want to understand the attacks, not just block them? [Techbox Login Security Pro](https://techboxdesign.com) is a separate add-on that builds on everything in this free plugin and adds: * **Login intelligence** — a dedicated Intelligence dashboard with your current threat level, attack patterns (credential stuffing, peak hours, admin targeting, bot blocks), top attacker IPs and usernames, recent lockouts, and a regional breakdown. * **Country (geo) blocking** — local IP2Location BIN lookup at login with an optional trusted CDN country header; site IP allow list always wins; fails open if data is unavailable. * **Enhanced login log** — success-row role enrichment, larger page sizes, and ** CSV export** of log data, respecting active filters. * **Username & probe policies** — per-username attempt limits, invalid-name (probe) protection against username enumeration, and username allow/deny lists. * **Bot login protection** — user-agent blocklist and a honeypot field (both off until enabled). * **Session controls** — ban / unban users from Sessions and log rows (kick remains available in the free plugin). Pro is completely optional — this free plugin is fully functional on its own. #### Privacy Storage and CSV exports are local to your site. The activity log and exports include IP addresses and usernames so you can audit sign-ins; remove or restrict access if your policies require it. This free plugin makes no third-party API calls for login enforcement or licensing. Paid capabilities live in a separate Pro add-on distributed outside WordPress.org. ### External services This free plugin does not connect to external licensing, analytics, or update services. Updates ship through WordPress.org. Optional Pro features are provided by a separately installed add-on; that add-on’s own privacy and licensing disclosures apply when it is installed. ## Screenshots [[ [[ [[ [[ ## Installation 1. Upload the plugin to `/wp-content/plugins/techbox-login-security/`, or install it from the Plugins screen. 2. Activate it from the **Plugins** screen. 3. Open **TB Login Security Settings**. Recommended defaults are applied on first activation; review **Login security** and the **Advanced** tab to tune limits, lists, and optional features. ## FAQ ### Do I need to be technical to use it? No. Techbox Login Security protects your site automatically the moment you activate it, using recommended defaults. If you ever want to change something, the settings are written in plain language. ### Will it lock me or my users out — or break my site if something goes wrong? Login limits are set conservatively by default and your allow list always wins, so you can add your own IP and never worry about it. Country lookups fail open ( allow) when data is unavailable, and Pro licensing is fail-soft — if a license can’t be validated, Pro features simply turn off while your core login protection keeps working. ### Will it slow down my site? No. Techbox Login Security only runs at the login stage and makes no external API calls for enforcement, so it adds no overhead to your normal page loads. ### Can I see who successfully logged in, not just failed attempts? Yes — and it is included free. Techbox Login Security logs successful sign-ins alongside failed attempts and lockouts, with the user and IP address for each. Beyond security, that is a simple way to see which members or customers actually use your site, and how often. (Pro adds each user’s role to successful sign-in rows.) ### Does it protect WooCommerce logins? Yes. Protection applies to the classic WooCommerce **My Account** and **checkout** login forms, including attempt limits, lockouts, and the optional email login code.( Block-based / Store API checkout notices are not yet supported.) ### Is the email login code the same as two-factor authentication (2FA)? It is a lightweight **email verification code** at login — optional and role-based. Full authenticator-app (TOTP) and SMS two-factor with backup codes are planned for a future release. ### Does it replace a firewall or a CDN? No, and it is not meant to. Techbox Login Security focuses on doing one thing extremely well — protecting your WordPress login. It works alongside a CDN or server firewall rather than replacing them. ### Can I reset everything to a safe default? Yes. Every settings section has a one-click **Restore recommended** button that puts protection back to its recommended baseline. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Techbox Login Security – Limit Login Attempts, Brute Force & Secure Login” is open source software. The following people have contributed to this plugin. Contributors * [ techboxdesign ](https://profiles.wordpress.org/techboxdesign/) [Translate “Techbox Login Security – Limit Login Attempts, Brute Force & Secure Login” into your language.](https://translate.wordpress.org/projects/wp-plugins/techbox-login-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/techbox-login-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/techbox-login-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/techbox-login-security/) by [RSS](https://plugins.trac.wordpress.org/log/techbox-login-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.4.1 * New guided setup: a short first-run walkthrough with a login security scan and recommended settings. * Guided setup is also offered after reinstalls and can be reopened anytime from Settings. * Dashboard remembers your selected time period. * IP allow and deny lists now accept IPv6 ranges. * Clearer, more predictable login-limit policies for XML-RPC and REST. * Security and reliability hardening. * Admin UX polish. #### 1.3.1 * Accessibility improvements on the settings screens. * Settings form reliability hardening. * Admin UX polish. #### 1.3.0 * Refreshed plugin branding (new icon and banner). * Rewritten plugin description and expanded FAQ. * Documentation updates. #### 1.2.2 * Reliability fix for sites upgrading from earlier installs. #### 1.2.1 * Compatibility and reliability updates. #### 1.2.0 * Admin UX polish and clearer notifications. * Support and documentation updates. #### 1.1.0 * Activity log and session management improvements. * Admin branding and usability updates. * Security and reliability hardening. #### 1.0.11 * First public release. ## Meta * Version **1.4.1** * Last updated **1 week ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.0.4** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/techbox-login-security/) * Tags * [brute force protection](https://test.wordpress.org/plugins/tags/brute-force-protection/) [limit login attempts](https://test.wordpress.org/plugins/tags/limit-login-attempts/) [login protection](https://test.wordpress.org/plugins/tags/login-protection/) [login security](https://test.wordpress.org/plugins/tags/login-security/)[secure login](https://test.wordpress.org/plugins/tags/secure-login/) * [Advanced View](https://test.wordpress.org/plugins/techbox-login-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/techbox-login-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/techbox-login-security/reviews/) ## Contributors * [ techboxdesign ](https://profiles.wordpress.org/techboxdesign/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/techbox-login-security/)