Kaya Studio

Why use “Kaya Login Captcha”?
This plugin Adds a simple captcha on login form, register form and lost-password form.
Easy install and use, captcha settings are fully customizable and you can choose the forms on which to display it. The blocked request HTTP status can be customized and the XML-RPC feature can be disabled.
Captcha statistics are also available on the settings page, with the count of passed and blocked requests sorted by year and month.
<h4>Features</h4>
<ul>
<li>Captcha available on the login form (Dashboard and WooCommerce).</li>
<li>Captcha available on the lost-password form (Dashboard and WooCommerce).</li>
<li>Captcha available on the register form (Dashboard and WooCommerce).</li>
<li>Editable Captcha code length.</li>
<li>Editable Captcha code format: numeric, alphabetic or alphanumeric.</li>
<li>Random lines available in the background of the Captcha.</li>
<li>Editable blocked request HTTP status.</li>
<li>XML-RPC WordPress API deactivatable.</li>
<li>Captcha statistics of passed and blocked requests sorted by year and month.</li>
<li>Compatible with WordPress MultiSite and WooCommerce.</li>
</ul>
“Kaya Login Captcha” is a professional login captcha system with fully customizable settings.
<h4>Privacy</h4>
This plugin does not collect or store any user data. It does not set any cookies and does not connect to any third-party applications. This plugin only generate a captcha code to verify human action for selected forms on your settings.
<h4>Available Languages</h4>
<ul>
<li>English.</li>
<li>French.</li>
</ul>
<h4>Feedback</h4>
Any suggestions or feedback is welcome, thank you for using or trying one of my plugins. Please take the time to let me know about your experiences and rate this plugin.

Kaya Login Captcha

Adds a simple captcha on login form, register form and lost-password form.

Ralf Naumann

eSherpa Login Guard effectively and intelligently protects your WordPress site from brute-force attacks – Swiss precision, completely without external dependencies.
Key Features:
<ul>
<li>Honeypot-first bot defense: JavaScript Honeypot detects non-browser bots and triggers immediate lockout logic.</li>
<li>Protected username trap: Immediate lockout for defined usernames (e.g., “admin”, “test”), independent of the regular counter.</li>
<li>Proactive User-Agent blocking: Block known bot signatures before login processing (exact match or substring mode).</li>
<li>Blocked User-Agent attempt log: Separate log table for blocked User-Agent requests including matching pattern.</li>
<li>WordPress hardening options: Disable XML-RPC (with fake-user honeypot response), hide REST user endpoint, and block author archive enumeration.</li>
<li>Optional bot password capture: Store attempted passwords from detected JS-honeypot bots for incident analysis.</li>
<li>Neutral login error option: Hide username enumeration by using neutral WordPress login error responses.</li>
<li>Live security visibility: Live alarm in admin, lockout badge in menu, and detailed failed-attempt logs with IP/User-Agent filters.</li>
<li>Progressive lockout durations: Lockout time increases on repeat offenses (e.g., 15 → 30 → 60 → 120 minutes).</li>
<li>Login page guidance: Clear countdown and “X attempts remaining” notice for transparent lock state.</li>
<li>Privacy-compliant: IPs stored only as anonymized hashes.</li>
<li>Automatic cleanup of old failed attempts (configurable).</li>
<li>Mobile-friendly admin tables: Horizontal scrolling for wide security tables on small screens, including swipe hint.</li>
<li>Email notification to admin on attacks against existing users.</li>
</ul>
Developed in Switzerland – fast, clean, performant, and multilingual ready.
Compatible with WordPress 6.9 and tested up to PHP 8.5.3.

eSherpa Login Guard

Intelligent login protection with honeypot detection, WordPress hardening, and a clear security admin overview.

Kaya Login Captcha vs eSherpa Login Guard