chrisguitarguy

Simple login lock down is a way to protect your WordPress blog from brute force login attacks.
How it works: 
1. An attacker attempts to login and fails 
2. Simple Login Lockdown record that failed login 
3. After a certain number of failed attemps (defaults to five), further attemps to access the wp-login.php page are blocked for a time (defaults to one hour).
If you happen to forget your password and make a failed login attemp yourself, the plugin will clear out the lockdown count data on successful login.
Note: This uses $_SERVER[‘REMOTE_ADDR’] directly. If you’re behind a proxy (load balancer, etc), it’s not going to work as expected. Eg. Several folks could be attempting logins at once, and all fail. As such, the plugin would pick up on all those requests coming from the same IP — the load balancer — and lock the login down. No good. If you’re using a load balancer or in some other situation where you’re behind a proxy, use this as an example and write your own. Or filter the IP as your desire using <code>cd_sll_pre_ip</code>.
<h3>Hooks</h3>
<pre><code>simple_login_lockdown_ip -- Alter the requesting IP address. Might be useful if you site is behind a proxy or load balancer.

simple_login_lockdown_allow_ip -- Allows you to "whitelist" an IP address. It first when a log attempt fails before the attempt count is incremented. Return true and no count will be taken for the IP.

simple_login_lockdown_should_die -- A filter that allows you to prevent the login page from `die`ing if a the requesting IP is temporarily blacklisted or the login limit has been reached.

simple_login_lockdown_count_reached -- Fires when the requesting IP has reached its count and will be added to the blacklist for your time limit.

simple_login_lockdown_attempt -- Fires when a login attempt is made but the requestin IP is blocked to to excessive requests.

simple_login_lockdown_response -- Change the HTTP response code of that gets sent when a blacklisted IP attempts to login.

simple_login_lockdown_time_values -- Allows you to alter values in the login lockdown time dropdown in the admin area.
</code></pre>

Simple Login Lockdown

Simple Login Lockdown prevents brute force login attacks/attempts on your WordPress installation.

Ivan

The Google Authenticator plugin for WordPress gives you two-factor authentication using the Google Authenticator app for Android/iPhone/Blackberry.
If you are security aware, you may already have the Google Authenticator app installed on your smartphone, using it for two-factor authentication on Gmail/Dropbox/Lastpass/Amazon etc.
The two-factor authentication requirement can be enabled on a per-user basis. You could enable it for your administrator account, but log in as usual with less privileged accounts.
If You need to maintain your blog using an Android/iPhone app, or any other software using the XMLRPC interface, you can enable the App password feature in this plugin, 
but please note that enabling the App password feature will make your blog less secure.
<h3>Credits</h3>
Thanks to:
<a href="https://profiles.wordpress.org/evinak/" rel="nofollow ugc">Oleksiy</a> for a bugfix in multisite.
<a href="https://github.com/pancek" rel="nofollow ugc">Paweł Nowacki</a> for the Polish translation
<a href="https://github.com/FabioZumbi12" rel="nofollow ugc">Fabio Zumbi</a> for the Portuguese translation
<a href="https://www.guidoschalkx.com/" rel="nofollow ugc">Guido Schalkx</a> for the Dutch translation.
<a href="https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=henrik%40schack%2edk&lc=US&item_name=Google%20Authenticator&item_number=Google%20Authenticator&no_shipping=0&no_note=1&tax=0&bn=PP%2dDonationsBF&charset=UTF%2d8" rel="nofollow ugc">Henrik.Schack</a> for writing/maintaining versions 0.20 through 0.48
<a href="http://tobias.baethge.com/" rel="nofollow ugc">Tobias Bäthge</a> for his code rewrite and German translation.
<a href="http://blog.pcode.nl/" rel="nofollow ugc">Pascal de Bruijn</a> for his “relaxed mode” idea.
<a href="http://technobabbl.es/" rel="nofollow ugc">Daniel Werl</a> for his usability tips.
<a href="http://dd32.id.au/" rel="nofollow ugc">Dion Hulse</a> for his bugfixes.
<a href="https://profiles.wordpress.org/users/aldolat/" rel="nofollow ugc">Aldo Latino</a> for his Italian translation.
<a href="http://www.kaijia.me/" rel="nofollow ugc">Kaijia Feng</a> for his Simplified Chinese translation.
<a href="http://www.buayacorp.com/" rel="nofollow ugc">Alex Concha</a> for his security tips.
<a href="http://jetienne.com/" rel="nofollow ugc">Jerome Etienne</a> for his jquery-qrcode plugin.
<a href="http://orizhial.com/" rel="nofollow ugc">Sébastien Prunier</a> for his Spanish and French translation.

Google Authenticator

Personally I feel 2FA should be a part of WordPress core. But since it isn't, plugins like this one are a must-have to secure your sites.

The configuration interface is clearly layed out and the login page fits in perfectly with the default WP login page styling.

This plugin is light-weight, unobtrusive, free and adds that extra layer of security. Should your admin credentials ever be compromised, 2FA will keep your site secure.

Must-have security plugin

Awesome plugin, which is almost always in first group of plugin I've install on new website. Thank you for create and maintain it.

One on few my first-to-install plugin

Google Authenticator for your WordPress blog.

Simple Login Lockdown vs Google Authenticator