ProgrammeLab

WP Ultimate Security

<h4>WORDPRESS SECURITY PLUGIN — PROTECTION WITHOUT THE COMPLEXITY</h4>
<p>Automated bots probe WordPress logins and forms around the clock. Ultimate Security shuts that down — with two-factor authentication, brute-force lockouts, anti-spam CAPTCHA, a hidden login URL, session controls, and security maintenance tools — all from a clean dashboard you do not need to be a security expert to run.</p>
<p>🎥 <strong>Watch a 2-minute intro:</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/wip2sejhJkQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<p>🛡️ <strong>Lightweight. Privacy-first. No bloat.</strong></p>
<h4>Why Ultimate Security?</h4>
<ul>
<li><strong>It just works.</strong> Sensible defaults out of the box — turn it on, you are safer in minutes.</li>
<li><strong>Built for real attacks.</strong> Stops the automated login, brute-force and spam traffic that actually hits WordPress sites.</li>
<li><strong>Zero learning curve.</strong> Plain-English settings, a Test Mode to preview rules before they go live.</li>
<li><strong>Privacy-respecting.</strong> No tracking, no data collection. Pro features are clearly labelled.</li>
</ul>
<p>🎥 <strong>Full Overview of Ultimate Security’s Dashboard:</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/efZo3vnMy_E?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h4>🔐 Login & Two-Factor Authentication</h4>
<ul>
<li><strong>Two-Factor Authentication (2FA)</strong> — Email one-time codes <strong>and</strong> authenticator apps via TOTP/HOTP. <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">Setup docs</a> · <a href="https://www.youtube.com/@wpultimatesecurity" rel="nofollow ugc">Video</a></li>
<li><strong>Per-user 2FA with role-based configuration options</strong> — Let users enable 2FA and configure which roles should use email or app-based 2FA.</li>
<li><strong>Brute-force login lockout</strong> — Limit failed attempts, auto-lock offenders, auto-reset retries, block specific users, and keep a recovery URL for emergencies.</li>
<li><strong>Custom login URL</strong> — Hide <code>wp-admin</code> / <code>wp-login.php</code> behind a secret address so bots cannot find it.</li>
<li><strong>Strong password policies</strong> — Enforce length, complexity, expiry and password history.</li>
<li><strong>Session control</strong> — Limit concurrent logins per user and harden auth cookies.</li>
</ul>
<h4>🤖 Bot & Brute-Force Protection</h4>
<ul>
<li><strong>Anti-spam CAPTCHA</strong> — Google reCAPTCHA v2/v3 <strong>and</strong> Cloudflare Turnstile.</li>
<li><strong>Form coverage</strong> — Protect WordPress login, registration and lost-password forms; Turnstile also supports comment forms; WooCommerce login/register forms are supported when enabled.</li>
<li><strong>No-conflict mode</strong> — Plays nicely alongside other CAPTCHA setups.</li>
</ul>
<h4>🧱 Security Maintenance & Controls</h4>
<ul>
<li>Rotate WordPress security keys / salts on demand.</li>
<li>Use the Update Manager to control WordPress core, plugin and theme update behavior.</li>
<li>Connect Cloudflare and deploy configurable WAF rule groups from the dashboard.</li>
<li>Review a basic Security Score with prioritized security checks.</li>
<li>Advanced hardening toggles, API privacy filtering and scheduled salt rotation are available in Pro.</li>
</ul>
<h4>📊 Monitoring & Tools</h4>
<ul>
<li><strong>Login Activity snapshot</strong> — Review recent successful and failed login activity from the dashboard.</li>
<li><strong>Basic Security Score</strong> — See a scored security posture based on enabled protections.</li>
<li><strong>Site Health snapshot</strong> — WordPress/PHP versions, memory, active plugins and theme at a glance.</li>
<li><strong>Test Mode</strong> — Simulate security rules and review what <em>would</em> have been blocked before enforcing.</li>
<li><strong>Settings backup & restore</strong> — Export/import your configuration as JSON for migrations or disaster recovery.</li>
</ul>
<p>👉 <strong><a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">Check Out »</a></strong></p>
<h4>🛠️ Recommended setups by use case</h4>
<p>Different sites face different threats. Start with the profile that matches you, then layer on more from the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<ul>
<li><strong>Solo blogger / personal site</strong> — Enable Email 2FA on the admin account, set a 5-attempt login lockout with a 15-minute cooldown, set a custom login URL, and add Cloudflare Turnstile to the comment form.</li>
<li><strong>Small agency / multi-author site</strong> — Require authenticator-app 2FA per role for editor and above, enforce password length + history, cap concurrent logins per user, and enable Test Mode before tightening rules.</li>
<li><strong>WooCommerce store</strong> — Add reCAPTCHA or Turnstile to login, registration and lost-password forms, set a custom login URL, enable brute-force lockout, and review Site Health weekly.</li>
<li><strong>Membership / community site</strong> — Per-user 2FA enabled site-wide, strong password policy, session limits to block account sharing, and CAPTCHA on registration to keep bot signups out.</li>
</ul>
<p>Each setup uses only free features. See the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">full setup guides</a> for step-by-step instructions.</p>
<h3>📖 Security terms in plain English</h3>
<p>New to WordPress security? Here is what the jargon means and why each one matters.</p>
<ul>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/login-authentication/email-otp/" rel="nofollow ugc">Two-Factor Authentication</a> (<a href="https://docs.wpultimatesecurity.com/docs/login-authentication/authentication-apps/" rel="nofollow ugc">2FA</a>)</strong> — A second proof of identity (a one-time code) on top of your password, so a stolen password alone cannot log in.</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/brute-force-protection/login-attempts/" rel="nofollow ugc">Brute force</a></strong> — Automated tools that guess thousands of password combinations against your login form; lockouts cut them off after a few failures.</li>
<li><strong>CAPTCHA</strong> — A <a href="https://docs.wpultimatesecurity.com/docs/bot-protection/google-recaptcha/" rel="nofollow ugc">small puzzle</a> or <a href="https://docs.wpultimatesecurity.com/docs/bot-protection/cloudflare-turnstile/" rel="nofollow ugc">invisible check</a> that confirms a real human is filling out a form, blocking most spam bots.</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/login-authentication/custom-login-url/" rel="nofollow ugc">Custom login URL</a></strong> — Moving your login page from the well-known <code>/wp-login.php</code> to a secret path so automated scanners cannot find it.</li>
<li><strong>Hardening</strong> — Turning off WordPress features attackers abuse but most sites do not need (file editor, XML-RPC, user enumeration, directory browsing).</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/security-keys/wordpress-security-keys/" rel="nofollow ugc">Salt rotation</a></strong> — Replacing the random secret keys in <code>wp-config.php</code> to invalidate stolen sessions and force re-login everywhere.</li>
<li><strong>Session control</strong> — Limiting how many places one account can be logged in at once and hardening the auth cookie.</li>
<li><strong>Test Mode</strong> — Previewing which requests a new rule would have blocked, before the rule starts blocking anything for real.</li>
</ul>
<p>Each term links to deeper reading in the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<h4>📚 Learn more</h4>
<ul>
<li>🌐 <a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">Website</a> — features, articles and more.</li>
<li>📘 <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">Documentation</a> — setup guides, troubleshooting, and how-tos.</li>
<li>🎥 <a href="https://www.youtube.com/@wpultimatesecurity" rel="nofollow ugc">YouTube channel</a> — video walkthroughs and tutorials.</li>
</ul>
<h4>🎯 Featured guides</h4>
<p>Short, focused reads that get most sites secure in under an hour. All link into the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<ul>
<li><strong>Set up Email 2FA for your admin account</strong> — the fastest single thing you can do to block account takeover.</li>
<li><strong>Add an authenticator app (TOTP/HOTP) for stronger 2FA</strong> — Google Authenticator, Authy, Microsoft Authenticator.</li>
<li><strong>Pick a safe custom login URL</strong> — what to choose, what to avoid, how to recover if you forget it.</li>
<li><strong>Add reCAPTCHA or Cloudflare Turnstile to your forms</strong> — including WooCommerce login and registration.</li>
<li><strong>Tune brute-force lockout without locking yourself out</strong> — sane attempt limits, lockout duration, allowlists.</li>
<li><strong>Rotate WordPress security keys (salts) safely</strong> — when to rotate, what it logs everyone out of, and how to schedule it.</li>
</ul>
<h3>🔗 Follow Ultimate Security</h3>
<ul>
<li>Website: <a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">https://wpultimatesecurity.com/</a></li>
<li>Documentation: <a href="https://docs.wpultimatesecurity.com" rel="nofollow ugc">https://docs.wpultimatesecurity.com/</a></li>
<li>Blog: <a href="https://wpultimatesecurity.com/blogs" rel="nofollow ugc">https://wpultimatesecurity.com/blogs/</a></li>
<li>X (Twitter): <a href="https://x.com/WPUSecurity" rel="nofollow ugc">https://x.com/WPUSecurity</a></li>
<li>Facebook: <a href="https://facebook.com/wpultimatesecurity" rel="nofollow ugc">https://facebook.com/wpultimatesecurity/</a></li>
<li>YouTube: <a href="https://youtube.com/@wpultimatesecurity" rel="nofollow ugc">https://youtube.com/@wpultimatesecurity/</a></li>
<li>Instagram: <a href="https://instagram.com/wpultimatesecurity" rel="nofollow ugc">https://instagram.com/wpultimatesecurity/</a></li>
<li>LinkedIn: <a href="https://linkedin.com/company/wpultimatesecurity" rel="nofollow ugc">https://linkedin.com/company/wpultimatesecurity/</a></li>
<li>Threads: <a href="https://threads.com/@wpultimatesecurity" rel="nofollow ugc">https://threads.com/@wpultimatesecurity/</a></li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to the following third-party services, and only when you explicitly enable the related feature:</p>
<h4>Google reCAPTCHA</h4>
<ul>
<li>When: reCAPTCHA CAPTCHA protection is enabled.</li>
<li>Data sent: the visitor’s reCAPTCHA response token and your site secret key.</li>
<li>Endpoint: https://www.google.com/recaptcha/api/siteverify</li>
<li>Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>Cloudflare Turnstile</h4>
<ul>
<li>When: Cloudflare Turnstile CAPTCHA protection is enabled.</li>
<li>Data sent: the visitor’s Turnstile response token and your site secret key.</li>
<li>Endpoint: https://challenges.cloudflare.com/turnstile/v0/siteverify</li>
<li>Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>WordPress.org Secret-Key (Salt) API</h4>
<ul>
<li>When: you request rotation of WordPress security keys/salts.</li>
<li>Data sent: a request for randomly generated salt strings (no site or user data).</li>
<li>Endpoint: https://api.wordpress.org/secret-key/1.1/salt/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>WordPress.org Core Version Check</h4>
<ul>
<li>When: the Update Manager checks for available WordPress core updates.</li>
<li>Data sent: a standard WordPress core version-check request (no user data).</li>
<li>Endpoint: https://api.wordpress.org/core/version-check/1.7/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>Cloudflare API</h4>
<ul>
<li>When: you connect Cloudflare or deploy/view WAF rules.</li>
<li>Data sent: Cloudflare credentials/token, selected zone/rule data, and Cloudflare API requests needed for verification, deployment and analytics.</li>
<li>Endpoint: https://api.cloudflare.com/client/v4/</li>
<li>Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>


Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools

Block hackers, bots and brute-force attacks with 2FA, CAPTCHA, login protection, session controls, security tools and more.

Konceptwise Digital Media Pvt Ltd

<p>Authyo Passwordless Login is a WordPress login security plugin that protects your site with brute-force protection, IP blacklisting, security activity logs, XML-RPC blocking, REST API protection, and a custom login URL. All security features work immediately after activation — no API keys or account registration needed.</p>
<p>Optionally, add Authyo API credentials to enable passwordless OTP login where users log in with a one-time password sent to their email instead of a traditional password.</p>
<p><strong>Security features that work without API keys:</strong></p>
<ul>
<li><strong>Brute-force protection</strong> — Limit login attempts per IP and username with progressive lockout durations. Repeat offenders are automatically blacklisted.</li>
<li><strong>IP Manager</strong> — Whitelist trusted IPs and blacklist attackers. Includes search, filter, pagination, and per-page selector for large lists.</li>
<li><strong>Security activity logs</strong> — Track every login, logout, failed attempt, lockout, and blocked access. Includes request URL tracking, date filters, search, and CSV export.</li>
<li><strong>Disable XML-RPC</strong> — Block xmlrpc.php requests at the server level using .htaccess rules. Removes X-Pingback headers and XML-RPC discovery links. Falls back to PHP blocking on Nginx.</li>
<li><strong>REST API Protection</strong> — Restrict access to WordPress REST API endpoints for unauthenticated users. Prevents data enumeration and unauthorized access while keeping essential endpoints functional.</li>
<li><strong>Custom login URL</strong> — Hide wp-login.php behind a custom URL slug to prevent automated attacks.</li>
<li><strong>Blocked IP logging</strong> — Every access attempt from blacklisted or locked-out IPs is logged with IP address, user agent, and request URL.</li>
</ul>
<p><strong>Passwordless login features (requires free Authyo API keys):</strong></p>
<ul>
<li><strong>Email OTP login</strong> — Users receive a one-time password via email and log in without a traditional password.</li>
<li><strong>Google Authenticator fallback</strong> — Server-side verified 2FA as a backup method after multiple OTP attempts.</li>
<li><strong>Secure login tokens</strong> — Cryptographically generated, single-use, browser-bound tokens that expire after 5 minutes.</li>
<li><strong>AJAX-powered login</strong> — Smooth login experience with no page reloads.</li>
</ul>
<h3>How It Works</h3>
<p><strong>Security (works immediately after activation):</strong></p>
<ol>
<li>Activate the plugin — brute-force protection and security logs start automatically</li>
<li>Go to Settings > Authyo Passwordless Login > Security tab</li>
<li>Enable XML-RPC Protection, REST API Protection, and Custom Login URL as needed</li>
<li>Visit Authyo Logs to monitor activity and manage IPs</li>
</ol>
<p><strong>Passwordless login (requires API keys):</strong></p>
<ol>
<li>User enters their email on the WordPress login page</li>
<li>A one-time password (OTP) is sent to their email</li>
<li>User enters the OTP code</li>
<li>WordPress logs the user in automatically — no password required</li>
</ol>
<h3>External Services</h3>
<p>This plugin connects to Authyo’s external API only for passwordless login and Google Authenticator features. All security features (brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, custom login URL) work locally without any external service.</p>
<p><strong>OTP Authentication:</strong></p>
<ul>
<li>User email address is sent to Authyo API when requesting an OTP</li>
<li>OTP code and Mask ID are sent to Authyo API for verification</li>
</ul>
<p><strong>Google Authenticator Verification:</strong></p>
<ul>
<li>Verification token is sent to Authyo API for server-side validation</li>
<li>The Authyo 2FA SDK script is loaded from <a href="https://app.authyo.io/js/v1/auth-2fasdk.js" rel="nofollow ugc">https://app.authyo.io/js/v1/auth-2fasdk.js</a></li>
</ul>
<p><strong>Usage Tracking (Opt-In Only):</strong></p>
<p>If the user explicitly opts in, plugin version, WordPress version, and site URL are sent when settings are saved. Deactivation feedback is sent when the plugin is deactivated. No tracking data is sent without user consent.</p>
<p><strong>Authentication Flow:</strong></p>
<ul>
<li>After OTP verification, the plugin generates a secure single-use token using WordPress core functions</li>
<li>Token is browser-bound using a hashed User-Agent signature to prevent session hijacking</li>
<li>Token is stored temporarily in WordPress transients (5-minute expiry) and deleted immediately after use</li>
</ul>
<p><strong>Data Storage:</strong></p>
<ul>
<li>OTP session data stored temporarily in WordPress transients (10-minute expiry)</li>
<li>Login tokens stored temporarily in WordPress transients (5-minute expiry, single-use)</li>
<li>Security logs stored in a custom database table with configurable retention</li>
<li>IP whitelist and blacklist stored in a custom database table</li>
<li>No user data is permanently stored beyond security logs</li>
</ul>
<p><strong>Service URLs:</strong></p>
<ul>
<li>API: <a href="https://app.authyo.io/api/v1/" rel="nofollow ugc">https://app.authyo.io/api/v1/</a></li>
<li>2FA SDK: <a href="https://app.authyo.io/js/v1/auth-2fasdk.js" rel="nofollow ugc">https://app.authyo.io/js/v1/auth-2fasdk.js</a></li>
</ul>
<p><strong>Terms of Service:</strong> <a href="https://authyo.io/terms-service" rel="nofollow ugc">https://authyo.io/terms-service</a><br />
<strong>Privacy Policy:</strong> <a href="https://authyo.io/privacy-policy" rel="nofollow ugc">https://authyo.io/privacy-policy</a></p>


Authyo Passwordless Login

WordPress login security with brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, and passwordless OTP login.

Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools vs Authyo Passwordless Login