WordPress login security controls
Loginizer-Security Pro is a WordPress security plugin focused on protecting login access and reducing automated brute-force attempts. It builds on login retry controls with additional authentication, CAPTCHA, IP management, URL customization, and file-checking tools. Administrators can configure these options from the WordPress administration area and choose the controls that fit their site.
Brute-force protection and access rules
Loginizer blocks an IP after the configured number of failed login attempts. The default configuration blocks an IP for 15 minutes after three failed attempts, and after multiple lockouts the IP is blocked for 24 hours. These settings can be changed from the Loginizer brute-force page.
- Review failed login attempt logs.
- Blacklist IP addresses that should not access login.
- Whitelist IP addresses that should be allowed.
- Allow access only from trusted IP addresses.
- Display a blocked screen instead of the login page.
- Customize error messages shown after failed login attempts.
- Receive email notifications after successful logins.
These controls are useful for sites where administrators want to monitor login activity, restrict known sources, or add an extra layer around the standard WordPress login process.
Authentication options
The Pro edition provides several ways to add verification to the login workflow. Passwordless Login asks for a username or email address and sends a temporary login link to the account email address. Email-based two-factor authentication sends a temporary six-digit code after login details are entered.
Users can also configure app-based two-factor authentication with an application such as Google Authenticator or Authy. A login challenge question provides another optional security layer: after login, the user must answer the configured question to complete access. Loginizer also lets users log in with LinkedIn.
CAPTCHA and WordPress URL controls
Administrators can configure Google reCAPTCHA v3 or v2, Cloudflare Turnstile, or hCAPTCHA for the login screen, comments section, and registration form. WooCommerce is supported as part of these CAPTCHA options, making the controls relevant to sites that use WooCommerce account or registration workflows.
To make common automated login paths less predictable, Loginizer can rename the login page slug from wp-login.php to another value. It can also rename the WordPress administration URL from wp-admin to a custom value such as site-admin. Rename Login with Secrecy keeps login URLs pointing to wp-login.php while requiring users to enter the new login slug directly. CSRF Protection updates the administration URL with a session string to make the URL harder to predict.
File checking and practical workflow
MD5 Checksum checks WordPress core files. Administrators can review the results and ignore files where appropriate. A practical setup can begin with brute-force settings and IP rules, followed by authentication requirements for selected users. CAPTCHA can then be configured for relevant forms, while URL settings and file checks provide additional administrative controls.
- Install and activate Loginizer-Security Pro in WordPress.
- Open the Loginizer settings and review brute-force options, logs, and IP rules.
- Choose passwordless login, email or app-based two-factor authentication, or a challenge question.
- Configure CAPTCHA, WooCommerce-related protection, and custom login or administration URLs as needed.
- Run the core file checksum check and review any files requiring attention.
Support
Loginizer-Security Pro includes professional support through the Premium Support Ticket System. Documentation is available for the Loginizer plugin, and free users can use the community support forums on WordPress.org.
