codegee0958

GhostGate is a lightweight yet powerful WordPress security plugin that eliminates the login page as an attack surface. Instead of just defending, it erases the entrance entirely with dynamic login URLs and multi-layer access verification.
<ul>
<li>🔒 Hide your login URL with a custom slug and time-based code</li>
<li>🔑 Built-in 2FA via email verification</li>
<li>🚫 Auto-block brute force attacks by IP</li>
<li>🧱 Disable/limit unused endpoints like XML-RPC and REST API</li>
<li>👤 Prevent user enumeration via REST, RSS, and author queries</li>
<li>🔍 Visualize security status and detect conflicts</li>
<li>📜 Activity logs with optional file rotation</li>
</ul>
GhostGate doesn’t just defend — it disappears. 
Invisible to bots. Intuitive for users.
👉 Full features / screenshots / pricing / docs: 
https://arce-experience.com/product/
<h3>Privacy</h3>
GhostGate can store the following data locally on your site to provide rate-limiting and security auditing: 
– IP addresses (for temporary throttling / block lists) 
– Timestamps and event metadata (login attempts, REST/XML-RPC hits) 
– Optional log files under <code>wp-content/uploads/ghostgate/logs</code> (if enabled)
No data is sent to third-party services. 
Site owners are responsible for informing users/visitors where required by local laws. You can clear blocks/logs from the admin UI or by deleting the log files.

GhostGate

Invisible, intelligent protection for WordPress. GhostGate hides your login page, blocks bots, and turns your site into a ghost fortress.

wpdo

In one click, your WordPress login page will be pretected with the smart brute force attack protection! Any login attempts more than 6 in 10 minutes (default value) will be limited.
Limit the number of login attempts through both the login and the auth cookies.
<ul>
<li>
Two-factor Authentication login.
</li>
<li>
Text SMS message passcode for 2nd step verification support.
</li>
<li>
Cloudflare Turnstile (better than Google reCAPTCHA).
</li>
<li>
GeoLocation (Continent/Country/City) or IP range to limit login attempts.
</li>
<li>
Passwordless login link.
</li>
<li>
Support Whitelist and Blacklist.
</li>
<li>
GDPR compliant. With this feature turned on, all logged IPs get obfuscated (md5-hashed).
</li>
<li>
WooCommerce Login supported.
</li>
<li>
XMLRPC gateway protection.
</li>
</ul>
<h4>API</h4>
<ul>
<li>
Call the function <code>$link = function_exists( 'dologin_gen_link' ) ? dologin_gen_link( 'your plugin name or tag' ) : '';</code> to generate one passwordless login link for the current user.
</li>
<li>
Call the function <code>$link = function_exists( 'dologin_gen_link' ) ? dologin_gen_link( 'note/tip for this generation', $user_id ) : '';</code> to generate a passwordless login link for the user which ID is <code>$user_id</code>.
</li>
</ul>
The generated one-time used link will be expired after 7 days.
<ul>
<li>Define const <code>SILENCE_INSTALL</code> to avoid redirecting to setting page after installtion.</li>
</ul>
<h4>CLI</h4>
<ul>
<li>
List all passwordless links: <code>wp dologin list</code>
</li>
<li>
Generate a passwordless link for one username (for the login name <code>root</code>): <code>wp dologin gen root</code>
</li>
<li>
Delete a passwordless link w/ the ID in list (for the record w/ ID 5): <code>wp dologin del 5</code>
</li>
</ul>
<h4>How GeoLocation works</h4>
When visitors hit the login page, this plugin will lookup the Geolocation info from API, compare the Geolocation setting (if has) with the whitelist/blacklist to decide if allow login attempts.
<h3>Privacy</h3>
The online IP lookup service is provided by https://www.doapi.us. The provider’s privacy policy is https://www.doapi.us/privacy.
Based on the original code from Limit Login Attemps plugin and Limit Login Attemps Reloaded plugin.

DoLogin Security

Easy Login. 2FA login. Passwordless login. Cloudflare Turnstile reCAPTCHA. GeoLocation (Continent/Country/City)/IP range to limit login attempts.

GhostGate vs DoLogin Security