ProgrammeLab

WP Ultimate Security

<h4>WORDPRESS SECURITY PLUGIN — PROTECTION WITHOUT THE COMPLEXITY</h4>
<p>Automated bots probe WordPress logins and forms around the clock. Ultimate Security shuts that down — with two-factor authentication, brute-force lockouts, anti-spam CAPTCHA, a hidden login URL, session controls, and security maintenance tools — all from a clean dashboard you do not need to be a security expert to run.</p>
<p>🎥 <strong>Watch a 2-minute intro:</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/wip2sejhJkQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<p>🛡️ <strong>Lightweight. Privacy-first. No bloat.</strong></p>
<h4>Why Ultimate Security?</h4>
<ul>
<li><strong>It just works.</strong> Sensible defaults out of the box — turn it on, you are safer in minutes.</li>
<li><strong>Built for real attacks.</strong> Stops the automated login, brute-force and spam traffic that actually hits WordPress sites.</li>
<li><strong>Zero learning curve.</strong> Plain-English settings, a Test Mode to preview rules before they go live.</li>
<li><strong>Privacy-respecting.</strong> No tracking, no data collection. Pro features are clearly labelled.</li>
</ul>
<p>🎥 <strong>Full Overview of Ultimate Security’s Dashboard:</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/efZo3vnMy_E?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h4>🔐 Login & Two-Factor Authentication</h4>
<ul>
<li><strong>Two-Factor Authentication (2FA)</strong> — Email one-time codes <strong>and</strong> authenticator apps via TOTP/HOTP. <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">Setup docs</a> · <a href="https://www.youtube.com/@wpultimatesecurity" rel="nofollow ugc">Video</a></li>
<li><strong>Per-user 2FA with role-based configuration options</strong> — Let users enable 2FA and configure which roles should use email or app-based 2FA.</li>
<li><strong>Brute-force login lockout</strong> — Limit failed attempts, auto-lock offenders, auto-reset retries, block specific users, and keep a recovery URL for emergencies.</li>
<li><strong>Custom login URL</strong> — Hide <code>wp-admin</code> / <code>wp-login.php</code> behind a secret address so bots cannot find it.</li>
<li><strong>Strong password policies</strong> — Enforce length, complexity, expiry and password history.</li>
<li><strong>Session control</strong> — Limit concurrent logins per user and harden auth cookies.</li>
</ul>
<h4>🤖 Bot & Brute-Force Protection</h4>
<ul>
<li><strong>Anti-spam CAPTCHA</strong> — Google reCAPTCHA v2/v3 <strong>and</strong> Cloudflare Turnstile.</li>
<li><strong>Form coverage</strong> — Protect WordPress login, registration and lost-password forms; Turnstile also supports comment forms; WooCommerce login/register forms are supported when enabled.</li>
<li><strong>No-conflict mode</strong> — Plays nicely alongside other CAPTCHA setups.</li>
</ul>
<h4>🧱 Security Maintenance & Controls</h4>
<ul>
<li>Rotate WordPress security keys / salts on demand.</li>
<li>Use the Update Manager to control WordPress core, plugin and theme update behavior.</li>
<li>Connect Cloudflare and deploy configurable WAF rule groups from the dashboard.</li>
<li>Review a basic Security Score with prioritized security checks.</li>
<li>Advanced hardening toggles, API privacy filtering and scheduled salt rotation are available in Pro.</li>
</ul>
<h4>📊 Monitoring & Tools</h4>
<ul>
<li><strong>Login Activity snapshot</strong> — Review recent successful and failed login activity from the dashboard.</li>
<li><strong>Basic Security Score</strong> — See a scored security posture based on enabled protections.</li>
<li><strong>Site Health snapshot</strong> — WordPress/PHP versions, memory, active plugins and theme at a glance.</li>
<li><strong>Test Mode</strong> — Simulate security rules and review what <em>would</em> have been blocked before enforcing.</li>
<li><strong>Settings backup & restore</strong> — Export/import your configuration as JSON for migrations or disaster recovery.</li>
</ul>
<p>👉 <strong><a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">Check Out »</a></strong></p>
<h4>🛠️ Recommended setups by use case</h4>
<p>Different sites face different threats. Start with the profile that matches you, then layer on more from the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<ul>
<li><strong>Solo blogger / personal site</strong> — Enable Email 2FA on the admin account, set a 5-attempt login lockout with a 15-minute cooldown, set a custom login URL, and add Cloudflare Turnstile to the comment form.</li>
<li><strong>Small agency / multi-author site</strong> — Require authenticator-app 2FA per role for editor and above, enforce password length + history, cap concurrent logins per user, and enable Test Mode before tightening rules.</li>
<li><strong>WooCommerce store</strong> — Add reCAPTCHA or Turnstile to login, registration and lost-password forms, set a custom login URL, enable brute-force lockout, and review Site Health weekly.</li>
<li><strong>Membership / community site</strong> — Per-user 2FA enabled site-wide, strong password policy, session limits to block account sharing, and CAPTCHA on registration to keep bot signups out.</li>
</ul>
<p>Each setup uses only free features. See the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">full setup guides</a> for step-by-step instructions.</p>
<h3>📖 Security terms in plain English</h3>
<p>New to WordPress security? Here is what the jargon means and why each one matters.</p>
<ul>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/login-authentication/email-otp/" rel="nofollow ugc">Two-Factor Authentication</a> (<a href="https://docs.wpultimatesecurity.com/docs/login-authentication/authentication-apps/" rel="nofollow ugc">2FA</a>)</strong> — A second proof of identity (a one-time code) on top of your password, so a stolen password alone cannot log in.</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/brute-force-protection/login-attempts/" rel="nofollow ugc">Brute force</a></strong> — Automated tools that guess thousands of password combinations against your login form; lockouts cut them off after a few failures.</li>
<li><strong>CAPTCHA</strong> — A <a href="https://docs.wpultimatesecurity.com/docs/bot-protection/google-recaptcha/" rel="nofollow ugc">small puzzle</a> or <a href="https://docs.wpultimatesecurity.com/docs/bot-protection/cloudflare-turnstile/" rel="nofollow ugc">invisible check</a> that confirms a real human is filling out a form, blocking most spam bots.</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/login-authentication/custom-login-url/" rel="nofollow ugc">Custom login URL</a></strong> — Moving your login page from the well-known <code>/wp-login.php</code> to a secret path so automated scanners cannot find it.</li>
<li><strong>Hardening</strong> — Turning off WordPress features attackers abuse but most sites do not need (file editor, XML-RPC, user enumeration, directory browsing).</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/security-keys/wordpress-security-keys/" rel="nofollow ugc">Salt rotation</a></strong> — Replacing the random secret keys in <code>wp-config.php</code> to invalidate stolen sessions and force re-login everywhere.</li>
<li><strong>Session control</strong> — Limiting how many places one account can be logged in at once and hardening the auth cookie.</li>
<li><strong>Test Mode</strong> — Previewing which requests a new rule would have blocked, before the rule starts blocking anything for real.</li>
</ul>
<p>Each term links to deeper reading in the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<h4>📚 Learn more</h4>
<ul>
<li>🌐 <a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">Website</a> — features, articles and more.</li>
<li>📘 <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">Documentation</a> — setup guides, troubleshooting, and how-tos.</li>
<li>🎥 <a href="https://www.youtube.com/@wpultimatesecurity" rel="nofollow ugc">YouTube channel</a> — video walkthroughs and tutorials.</li>
</ul>
<h4>🎯 Featured guides</h4>
<p>Short, focused reads that get most sites secure in under an hour. All link into the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<ul>
<li><strong>Set up Email 2FA for your admin account</strong> — the fastest single thing you can do to block account takeover.</li>
<li><strong>Add an authenticator app (TOTP/HOTP) for stronger 2FA</strong> — Google Authenticator, Authy, Microsoft Authenticator.</li>
<li><strong>Pick a safe custom login URL</strong> — what to choose, what to avoid, how to recover if you forget it.</li>
<li><strong>Add reCAPTCHA or Cloudflare Turnstile to your forms</strong> — including WooCommerce login and registration.</li>
<li><strong>Tune brute-force lockout without locking yourself out</strong> — sane attempt limits, lockout duration, allowlists.</li>
<li><strong>Rotate WordPress security keys (salts) safely</strong> — when to rotate, what it logs everyone out of, and how to schedule it.</li>
</ul>
<h3>🔗 Follow Ultimate Security</h3>
<ul>
<li>Website: <a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">https://wpultimatesecurity.com/</a></li>
<li>Documentation: <a href="https://docs.wpultimatesecurity.com" rel="nofollow ugc">https://docs.wpultimatesecurity.com/</a></li>
<li>Blog: <a href="https://wpultimatesecurity.com/blogs" rel="nofollow ugc">https://wpultimatesecurity.com/blogs/</a></li>
<li>X (Twitter): <a href="https://x.com/WPUSecurity" rel="nofollow ugc">https://x.com/WPUSecurity</a></li>
<li>Facebook: <a href="https://facebook.com/wpultimatesecurity" rel="nofollow ugc">https://facebook.com/wpultimatesecurity/</a></li>
<li>YouTube: <a href="https://youtube.com/@wpultimatesecurity" rel="nofollow ugc">https://youtube.com/@wpultimatesecurity/</a></li>
<li>Instagram: <a href="https://instagram.com/wpultimatesecurity" rel="nofollow ugc">https://instagram.com/wpultimatesecurity/</a></li>
<li>LinkedIn: <a href="https://linkedin.com/company/wpultimatesecurity" rel="nofollow ugc">https://linkedin.com/company/wpultimatesecurity/</a></li>
<li>Threads: <a href="https://threads.com/@wpultimatesecurity" rel="nofollow ugc">https://threads.com/@wpultimatesecurity/</a></li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to the following third-party services, and only when you explicitly enable the related feature:</p>
<h4>Google reCAPTCHA</h4>
<ul>
<li>When: reCAPTCHA CAPTCHA protection is enabled.</li>
<li>Data sent: the visitor’s reCAPTCHA response token and your site secret key.</li>
<li>Endpoint: https://www.google.com/recaptcha/api/siteverify</li>
<li>Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>Cloudflare Turnstile</h4>
<ul>
<li>When: Cloudflare Turnstile CAPTCHA protection is enabled.</li>
<li>Data sent: the visitor’s Turnstile response token and your site secret key.</li>
<li>Endpoint: https://challenges.cloudflare.com/turnstile/v0/siteverify</li>
<li>Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>WordPress.org Secret-Key (Salt) API</h4>
<ul>
<li>When: you request rotation of WordPress security keys/salts.</li>
<li>Data sent: a request for randomly generated salt strings (no site or user data).</li>
<li>Endpoint: https://api.wordpress.org/secret-key/1.1/salt/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>WordPress.org Core Version Check</h4>
<ul>
<li>When: the Update Manager checks for available WordPress core updates.</li>
<li>Data sent: a standard WordPress core version-check request (no user data).</li>
<li>Endpoint: https://api.wordpress.org/core/version-check/1.7/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>Cloudflare API</h4>
<ul>
<li>When: you connect Cloudflare or deploy/view WAF rules.</li>
<li>Data sent: Cloudflare credentials/token, selected zone/rule data, and Cloudflare API requests needed for verification, deployment and analytics.</li>
<li>Endpoint: https://api.cloudflare.com/client/v4/</li>
<li>Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>


Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools

Block hackers, bots and brute-force attacks with 2FA, CAPTCHA, login protection, session controls, security tools and more.

BerryPress

<p>LoginBerry bundles <strong>account verification</strong>, <strong>two-factor authentication (2FA)</strong>, <strong>passwordless login</strong>, and <strong>login logs</strong>. Each feature can be enabled or disabled independently. Outgoing codes are delivered by <strong>email</strong>.</p>
<p>The plugin works for standard WordPress sites. When WooCommerce is active, additional customer- and order-related options are available (for example 2FA on the My Account login form and optional account activation tied to orders).</p>
<h4>User-facing behavior (when features are enabled)</h4>
<ul>
<li><strong>Account verification:</strong> After registration, the user signs in and completes activation on the configured activation page using a six-digit code sent by email.</li>
<li><strong>Two-factor authentication:</strong> After a successful username and password, the user enters a second code sent by email. Per-role modes are Required, Optional, or Disabled.</li>
<li><strong>Passwordless login:</strong> On <code>wp-login.php</code>, eligible roles may request a one-time email code instead of entering a password.</li>
<li><strong>Login logs:</strong> Success and failure records are listed in the WordPress admin.</li>
</ul>
<p>Authentication codes are email-based; end users do not install a separate authenticator app for the flows described here.</p>
<h4>Account verification</h4>
<ul>
<li>New accounts receive a six-digit activation code by email.</li>
<li>After fifteen failed activation attempts, the account is locked until an administrator intervenes.</li>
<li>Administrators can resend codes, activate accounts manually, and unlock accounts from <strong>Users <span aria-hidden="true" class="wp-exclude-emoji">→</span> All Users</strong>.</li>
</ul>
<h4>Two-factor authentication (2FA)</h4>
<ul>
<li>Per-role setting: Required, Optional, or Disabled.</li>
<li>Optional mode allows users to enable 2FA from the profile when permitted by role.</li>
<li>Supported on <code>wp-login.php</code> and on the WooCommerce <strong>My Account</strong> login form.</li>
</ul>
<h4>Passwordless login</h4>
<p>Let users log in without a password – just enter a username or email and receive a one-time login code. Improves user experience while maintaining strong security through email verification.</p>
<ul>
<li>Toggle between password and passwordless login on wp-login.php</li>
<li>One-time email codes on <code>wp-login.php</code>, controlled per role.</li>
<li>When both passwordless login and 2FA are enabled for the same role, the passwordless flow does not require a separate 2FA step (email possession is already verified).</li>
</ul>
<h4>WooCommerce</h4>
<ul>
<li>Optional automatic account activation when an WooCommerce order is created.</li>
<li>Optional restriction so that only <strong>paid</strong> orders trigger activation.</li>
<li>Integration points include classic checkout, block checkout (Store API), and paid-order completion hooks, as implemented in the plugin.</li>
</ul>
<h4>Login logs</h4>
<p>Monitor all login activity on your site. Essential for detecting suspicious behavior and meeting security compliance requirements for e-commerce stores.</p>
<ul>
<li>Records successful and failed login attempts</li>
<li>Logs username, email, IP address, and timestamp</li>
<li>View all logs in a dedicated admin page with sortable columns</li>
<li>Identify patterns of brute force attacks and suspicious login activity</li>
<li>Audit trail for security compliance and fraud investigation</li>
</ul>
<h4>Admin interface</h4>
<ul>
<li>Centralized settings under <strong>BerryPress <span aria-hidden="true" class="wp-exclude-emoji">→</span> LoginBerry</strong>, with separate screens per feature.</li>
</ul>
<h4>Email templates</h4>
<p>HTML email templates for activation, 2FA, and passwordless login ship in the plugin <code>templates/</code> directory. To override, copy the desired template into the active theme or child theme under <code>templates/loginberry/</code> (see each template file header for the exact path).</p>
<h4>Email delivery</h4>
<p>Reliable outbound email is required for codes to arrive. Typical setups use the hosting provider’s mail relay, a transactional email API (for example Brevo, Mailchimp Transactional / Mandrill, Postmark, SendGrid, Amazon SES), or a WordPress plugin that sends mail via SMTP or a provider API. Test delivery with a real signup or code request before relying on the feature in production.</p>
<h4>Typical use cases</h4>
<ul>
<li>Reducing unwanted or automated registrations and limiting abuse of disposable email addresses.</li>
<li>Verifying that a customer or member controls the email address on file.</li>
<li>Adding a second factor after password entry for selected roles.</li>
<li>Reviewing login success and failure history in the admin.</li>
<li>WooCommerce: applying optional post-order account activation, including a paid-order-only mode where configured.</li>
</ul>
<h4>Roadmap</h4>
<p>LoginBerry is a brand new plugin and we are improving it quickly based on real user feedback. If you have ideas, feature requests, or run into a theme-specific styling issue, we would love to hear from you.</p>
<p>Planned work includes:</p>
<ul>
<li>Configurable failed-attempt limits (instead of the fixed fifteen for activation lockout)</li>
<li>Track last login time for each user</li>
<li>Custom activation page URL</li>
<li>Custom redirect URL after successful verification</li>
<li>Rate limiting on code verification attempts</li>
<li>Social login options</li>
<li>Improved styling flexibility and theme compatibility</li>
</ul>
<p>Feedback and compatibility reports are welcome via the plugin support channels. New features are prioritized based on user feedback.</p>


LoginBerry – 2FA, Passwordless & Email Verification

Complete login security for WordPress & WooCommerce: LoginBerry adds email-based account verification, optional two-factor authentication (2FA), o …

Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools vs LoginBerry – 2FA, Passwordless & Email Verification