ProgrammeLab

WP Ultimate Security

<h4>WORDPRESS SECURITY PLUGIN — PROTECTION WITHOUT THE COMPLEXITY</h4>
<p>Automated bots probe WordPress logins and forms around the clock. Ultimate Security shuts that down — with two-factor authentication, brute-force lockouts, anti-spam CAPTCHA, a hidden login URL, session controls, and security maintenance tools — all from a clean dashboard you do not need to be a security expert to run.</p>
<p>🎥 <strong>Watch a 2-minute intro:</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/wip2sejhJkQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<p>🛡️ <strong>Lightweight. Privacy-first. No bloat.</strong></p>
<h4>Why Ultimate Security?</h4>
<ul>
<li><strong>It just works.</strong> Sensible defaults out of the box — turn it on, you are safer in minutes.</li>
<li><strong>Built for real attacks.</strong> Stops the automated login, brute-force and spam traffic that actually hits WordPress sites.</li>
<li><strong>Zero learning curve.</strong> Plain-English settings, a Test Mode to preview rules before they go live.</li>
<li><strong>Privacy-respecting.</strong> No tracking, no data collection. Pro features are clearly labelled.</li>
</ul>
<p>🎥 <strong>Full Overview of Ultimate Security’s Dashboard:</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/efZo3vnMy_E?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h4>🔐 Login & Two-Factor Authentication</h4>
<ul>
<li><strong>Two-Factor Authentication (2FA)</strong> — Email one-time codes <strong>and</strong> authenticator apps via TOTP/HOTP. <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">Setup docs</a> · <a href="https://www.youtube.com/@wpultimatesecurity" rel="nofollow ugc">Video</a></li>
<li><strong>Per-user 2FA with role-based configuration options</strong> — Let users enable 2FA and configure which roles should use email or app-based 2FA.</li>
<li><strong>Brute-force login lockout</strong> — Limit failed attempts, auto-lock offenders, auto-reset retries, block specific users, and keep a recovery URL for emergencies.</li>
<li><strong>Custom login URL</strong> — Hide <code>wp-admin</code> / <code>wp-login.php</code> behind a secret address so bots cannot find it.</li>
<li><strong>Strong password policies</strong> — Enforce length, complexity, expiry and password history.</li>
<li><strong>Session control</strong> — Limit concurrent logins per user and harden auth cookies.</li>
</ul>
<h4>🤖 Bot & Brute-Force Protection</h4>
<ul>
<li><strong>Anti-spam CAPTCHA</strong> — Google reCAPTCHA v2/v3 <strong>and</strong> Cloudflare Turnstile.</li>
<li><strong>Form coverage</strong> — Protect WordPress login, registration and lost-password forms; Turnstile also supports comment forms; WooCommerce login/register forms are supported when enabled.</li>
<li><strong>No-conflict mode</strong> — Plays nicely alongside other CAPTCHA setups.</li>
</ul>
<h4>🧱 Security Maintenance & Controls</h4>
<ul>
<li>Rotate WordPress security keys / salts on demand.</li>
<li>Use the Update Manager to control WordPress core, plugin and theme update behavior.</li>
<li>Connect Cloudflare and deploy configurable WAF rule groups from the dashboard.</li>
<li>Review a basic Security Score with prioritized security checks.</li>
<li>Advanced hardening toggles, API privacy filtering and scheduled salt rotation are available in Pro.</li>
</ul>
<h4>📊 Monitoring & Tools</h4>
<ul>
<li><strong>Login Activity snapshot</strong> — Review recent successful and failed login activity from the dashboard.</li>
<li><strong>Basic Security Score</strong> — See a scored security posture based on enabled protections.</li>
<li><strong>Site Health snapshot</strong> — WordPress/PHP versions, memory, active plugins and theme at a glance.</li>
<li><strong>Test Mode</strong> — Simulate security rules and review what <em>would</em> have been blocked before enforcing.</li>
<li><strong>Settings backup & restore</strong> — Export/import your configuration as JSON for migrations or disaster recovery.</li>
</ul>
<p>👉 <strong><a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">Check Out »</a></strong></p>
<h4>🛠️ Recommended setups by use case</h4>
<p>Different sites face different threats. Start with the profile that matches you, then layer on more from the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<ul>
<li><strong>Solo blogger / personal site</strong> — Enable Email 2FA on the admin account, set a 5-attempt login lockout with a 15-minute cooldown, set a custom login URL, and add Cloudflare Turnstile to the comment form.</li>
<li><strong>Small agency / multi-author site</strong> — Require authenticator-app 2FA per role for editor and above, enforce password length + history, cap concurrent logins per user, and enable Test Mode before tightening rules.</li>
<li><strong>WooCommerce store</strong> — Add reCAPTCHA or Turnstile to login, registration and lost-password forms, set a custom login URL, enable brute-force lockout, and review Site Health weekly.</li>
<li><strong>Membership / community site</strong> — Per-user 2FA enabled site-wide, strong password policy, session limits to block account sharing, and CAPTCHA on registration to keep bot signups out.</li>
</ul>
<p>Each setup uses only free features. See the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">full setup guides</a> for step-by-step instructions.</p>
<h3>📖 Security terms in plain English</h3>
<p>New to WordPress security? Here is what the jargon means and why each one matters.</p>
<ul>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/login-authentication/email-otp/" rel="nofollow ugc">Two-Factor Authentication</a> (<a href="https://docs.wpultimatesecurity.com/docs/login-authentication/authentication-apps/" rel="nofollow ugc">2FA</a>)</strong> — A second proof of identity (a one-time code) on top of your password, so a stolen password alone cannot log in.</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/brute-force-protection/login-attempts/" rel="nofollow ugc">Brute force</a></strong> — Automated tools that guess thousands of password combinations against your login form; lockouts cut them off after a few failures.</li>
<li><strong>CAPTCHA</strong> — A <a href="https://docs.wpultimatesecurity.com/docs/bot-protection/google-recaptcha/" rel="nofollow ugc">small puzzle</a> or <a href="https://docs.wpultimatesecurity.com/docs/bot-protection/cloudflare-turnstile/" rel="nofollow ugc">invisible check</a> that confirms a real human is filling out a form, blocking most spam bots.</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/login-authentication/custom-login-url/" rel="nofollow ugc">Custom login URL</a></strong> — Moving your login page from the well-known <code>/wp-login.php</code> to a secret path so automated scanners cannot find it.</li>
<li><strong>Hardening</strong> — Turning off WordPress features attackers abuse but most sites do not need (file editor, XML-RPC, user enumeration, directory browsing).</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/security-keys/wordpress-security-keys/" rel="nofollow ugc">Salt rotation</a></strong> — Replacing the random secret keys in <code>wp-config.php</code> to invalidate stolen sessions and force re-login everywhere.</li>
<li><strong>Session control</strong> — Limiting how many places one account can be logged in at once and hardening the auth cookie.</li>
<li><strong>Test Mode</strong> — Previewing which requests a new rule would have blocked, before the rule starts blocking anything for real.</li>
</ul>
<p>Each term links to deeper reading in the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<h4>📚 Learn more</h4>
<ul>
<li>🌐 <a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">Website</a> — features, articles and more.</li>
<li>📘 <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">Documentation</a> — setup guides, troubleshooting, and how-tos.</li>
<li>🎥 <a href="https://www.youtube.com/@wpultimatesecurity" rel="nofollow ugc">YouTube channel</a> — video walkthroughs and tutorials.</li>
</ul>
<h4>🎯 Featured guides</h4>
<p>Short, focused reads that get most sites secure in under an hour. All link into the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<ul>
<li><strong>Set up Email 2FA for your admin account</strong> — the fastest single thing you can do to block account takeover.</li>
<li><strong>Add an authenticator app (TOTP/HOTP) for stronger 2FA</strong> — Google Authenticator, Authy, Microsoft Authenticator.</li>
<li><strong>Pick a safe custom login URL</strong> — what to choose, what to avoid, how to recover if you forget it.</li>
<li><strong>Add reCAPTCHA or Cloudflare Turnstile to your forms</strong> — including WooCommerce login and registration.</li>
<li><strong>Tune brute-force lockout without locking yourself out</strong> — sane attempt limits, lockout duration, allowlists.</li>
<li><strong>Rotate WordPress security keys (salts) safely</strong> — when to rotate, what it logs everyone out of, and how to schedule it.</li>
</ul>
<h3>🔗 Follow Ultimate Security</h3>
<ul>
<li>Website: <a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">https://wpultimatesecurity.com/</a></li>
<li>Documentation: <a href="https://docs.wpultimatesecurity.com" rel="nofollow ugc">https://docs.wpultimatesecurity.com/</a></li>
<li>Blog: <a href="https://wpultimatesecurity.com/blogs" rel="nofollow ugc">https://wpultimatesecurity.com/blogs/</a></li>
<li>X (Twitter): <a href="https://x.com/WPUSecurity" rel="nofollow ugc">https://x.com/WPUSecurity</a></li>
<li>Facebook: <a href="https://facebook.com/wpultimatesecurity" rel="nofollow ugc">https://facebook.com/wpultimatesecurity/</a></li>
<li>YouTube: <a href="https://youtube.com/@wpultimatesecurity" rel="nofollow ugc">https://youtube.com/@wpultimatesecurity/</a></li>
<li>Instagram: <a href="https://instagram.com/wpultimatesecurity" rel="nofollow ugc">https://instagram.com/wpultimatesecurity/</a></li>
<li>LinkedIn: <a href="https://linkedin.com/company/wpultimatesecurity" rel="nofollow ugc">https://linkedin.com/company/wpultimatesecurity/</a></li>
<li>Threads: <a href="https://threads.com/@wpultimatesecurity" rel="nofollow ugc">https://threads.com/@wpultimatesecurity/</a></li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to the following third-party services, and only when you explicitly enable the related feature:</p>
<h4>Google reCAPTCHA</h4>
<ul>
<li>When: reCAPTCHA CAPTCHA protection is enabled.</li>
<li>Data sent: the visitor’s reCAPTCHA response token and your site secret key.</li>
<li>Endpoint: https://www.google.com/recaptcha/api/siteverify</li>
<li>Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>Cloudflare Turnstile</h4>
<ul>
<li>When: Cloudflare Turnstile CAPTCHA protection is enabled.</li>
<li>Data sent: the visitor’s Turnstile response token and your site secret key.</li>
<li>Endpoint: https://challenges.cloudflare.com/turnstile/v0/siteverify</li>
<li>Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>WordPress.org Secret-Key (Salt) API</h4>
<ul>
<li>When: you request rotation of WordPress security keys/salts.</li>
<li>Data sent: a request for randomly generated salt strings (no site or user data).</li>
<li>Endpoint: https://api.wordpress.org/secret-key/1.1/salt/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>WordPress.org Core Version Check</h4>
<ul>
<li>When: the Update Manager checks for available WordPress core updates.</li>
<li>Data sent: a standard WordPress core version-check request (no user data).</li>
<li>Endpoint: https://api.wordpress.org/core/version-check/1.7/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>Cloudflare API</h4>
<ul>
<li>When: you connect Cloudflare or deploy/view WAF rules.</li>
<li>Data sent: Cloudflare credentials/token, selected zone/rule data, and Cloudflare API requests needed for verification, deployment and analytics.</li>
<li>Endpoint: https://api.cloudflare.com/client/v4/</li>
<li>Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>


Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools

Block hackers, bots and brute-force attacks with 2FA, CAPTCHA, login protection, session controls, security tools and more.

Melapress

WPWhiteSecurity

<p><strong> COMPREHENSIVE WORDPRESS LOGIN SECURITY PLUGIN </strong></p>
<p><a href="https://melapress.com/wordpress-login-security/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">Melapress Login Security</a> enables you to effortlessly set login security policies that put you firmly in the driver’s seat of your WordPress sites. Policies are highly customizable and granular and can be implemented by user role or site-wide for complete control over the security of your WordPress login processes.</p>
<p>Use the free edition of Melapress Login Security to implement WordPress password requirements such as minimum length and complexity rules. The plugin also allows you to set password expiration policies, prevent password reuse, limit failed login attempts, and automatically disable inactive user accounts, among other things. This helps you:</p>
<ul>
<li>Prevent unauthorized login attempts</li>
<li>Protect against brute force attacks</li>
<li>Comply with GDPR with a login consent notice</li>
</ul>
<h3>🔐 Features list</h3>
<p>A secure WordPress login starts right here. Explore all of the features included with the free edition of <a href="https://melapress.com/wordpress-login-security" rel="nofollow ugc">Melapress Login Security</a>:</p>
<h3>Set password policies</h3>
<p>Strong passwords are your first line of defense against bad actors looking to gain access to your site. Set password requirement policies to make sure users set strong passwords. Set policies by user role or site-wide and define policy priority for users with multiple roles.</p>
<ul>
<li>Set minimum password length</li>
<li>Require uppercase and lowercase characters, numbers, and special characters</li>
<li>Set an automatic password expiration policy and advise users when their password is about to expire</li>
<li>Disallow users from reusing passwords</li>
<li>Provide users with helpful instructions during the password configuration stage</li>
<li>Disable password reset links</li>
<li>Mandate WordPress password reset on the first login</li>
</ul>
<h3>Limit login attempts</h3>
<p><a href="https://melapress.com/support/kb/melapress-login-security-failed-logins-policy-wordpress/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">Limit failed login attempts</a> and put an end to brute force attacks. Protect your login form by automatically disabling user accounts after a number of failed login attempts. Choose between manual unlocking by an admin or automatic unlocking after a cooldown period.</p>
<h3>Temporary login without password</h3>
<p>Provide temporary and secure login access to third parties, like developers, editors, employees or others, without a password. It works by providing the user with a temporary login link that expires after a certain amount of time, or after a number of uses. This prevents you from having to create new user accounts manually, while simultaneously reducing the security risks associated with old, unused user accounts.</p>
<h3>Change WordPress login URL</h3>
<p>Easily deploy security-by-obscurity tactics and change your WordPress login page URL using a plugin! Hiding the default login page from hackers makes it more difficult to find, potentially reducing brute force attacks and other unauthorized access attempts. After you change the default wp-admin URL, you can set a 404 for the old login page or redirect it to any page of your choosing.</p>
<h3>Limit login page access by IP address(es)</h3>
<p>Limit access to the WordPress login page by IP address(es) for additional security.</p>
<h3>GDPR login page consent notice</h3>
<p>Easily meet GDPR requirements by adding a GDPR consent notice to the login page. This is required for GDPR and PCI DSS compliance, thus ensuring your WordPress site login page is in compliance.</p>
<h3>Emergency password reset</h3>
<p>Discovered suspicious behavior? Reset all users’ passwords with just one click and regain instant control.</p>
<h3>Upgrade to Melapress Login Security Premium and get even more benefits.</h3>
<p>The premium edition of Melapress Login Security comes bundled with even more features, which enable you to take your WordPress website login security to the next level. Disable inactive WordPress user accounts and force passwords to be reset once accounts have been unlocked. Inactive accounts can be managed within a single dashboard for increased efficiency and faster response times. Moreover, you can set accounts to be locked out after a number of failed login attempts and customize the duration and method of unlocking them.</p>
<h3>Premium features list</h3>
<ul>
<li><strong>Everything included in the free edition</strong></li>
<li><strong>Manually lock user accounts</strong> to immediately prevent login access for rarely used accounts or users on extended leave</li>
<li><strong>Add an extra security layer with security questions</strong> users must answer when performing sensitive actions such as password resets and account unlocks</li>
<li><strong>Receive email alerts for unrecognized device logins</strong>, with the option to remotely terminate the session</li>
<li><strong>Control user session duration</strong> by extending or shortening session timeouts to balance security and convenience</li>
<li><strong>One-click integration with third-party plugins</strong> such as WooCommerce, LearnDash, MemberPress, and many others</li>
<li><strong>Automatically <a href="https://melapress.com/inactive-users-wordpress/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">disable inactive WordPress users</a></strong> after a configurable period of inactivity</li>
<li><strong>Apply Geo-blocking rules</strong> to allow or block login access based on specific countries</li>
<li><strong><a href="https://melapress.com/support/kb/melapress-login-security-limit-login-ips/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">Restrict users’ login to specific IP addresses</a></strong>, including support for multiple allowed IPs</li>
<li><strong><a href="https://melapress.com/support/kb/restrict-users-log-in-time-wordpress-website/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">Restrict WordPress user login times</a></strong> by day and/or hours</li>
<li><strong>Limit login credentials</strong> to email address, username, or both</li>
<li><strong>Add a GDPR consent notice</strong> to the WordPress login page</li>
<li><strong>View detailed user security reports</strong>, including last activity, password age, and expired passwords</li>
<li><strong>Receive weekly email summary reports</strong> covering password resets, password changes, user account lockouts, and more</li>
</ul>
<p>|💎 <a href="https://melapress.com/wordpress-login-security/pricing/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">UPGRADE TO PREMIUM</a> |</p>
<h3>Why you should use Melapress Login Security</h3>
<p>Melapress Login Security is a WordPress plugin built from the ground up to help you improve the security of your user accounts and secure your WordPress login. Supercharge login credentials for maximum effectiveness and put a stop to unlimited login attempts, weak passwords, and inactive users. Set up policies to reduce your attack surface area such as login times restrictions, change the WordPress login URL, and much more.</p>
<h3>Free and premium support</h3>
<p>Support for the free edition of Melapress Login Security is free on the <a href="https://wordpress.org/support/plugin/melapress-login-security/" rel="ugc">WordPress support forums</a>. Premium world-class support via one-to-one email is available to the Premium users – <a href="https://melapress.com/wordpress-login-security/pricing/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">upgrade to premium</a> to benefit from priority support.</p>
<p>For any other queries, feedback, or if you simply want to get in touch with us, please use our <a href="https://melapress.com/contact/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">contact form</a>.</p>
<h4>MAINTAINED & SUPPORTED BY MELAPRESS</h4>
<p>Melapress builds high-quality WordPress security & admin plugins such as <a href="https://melapress.com/wordpress-2fa/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">WP 2FA</a>, <a href="https://melapress.com/wordpress-user-roles-editor/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">Melapress Role Editor</a>,and <a href="https://melapress.com/wordpress-activity-log/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">WP Activity Log</a>, the #1 user-rated activity log plugin for WordPress.</p>
<p><a href="https://melapress.com/?utm_source=wp+repo&utm_medium=repo+link&utm_campaign=wordpress_org&utm_content=mls" rel="nofollow ugc">Visit our website</a> to see how our plugins can help you better manage and improve the security and administration of your WordPress websites and users.</p>
<h3>Install the plugin from within WordPress</h3>
<p>Keeping a secure WordPress login page is easy with <a href="https://melapress.com/wordpress-login-security" rel="nofollow ugc">Melapress Login Security</a>. Simply:</p>
<ol>
<li>From your WordPress dashboard, navigate to Plugins > Add New</li>
<li>Search for “<a href="https://melapress.com/wordpress-login-security" rel="nofollow ugc">Melapress Login Security</a>”</li>
<li>Install & activate <a href="https://melapress.com/wordpress-login-security" rel="nofollow ugc">Melapress Login Security</a> from your Plugins page</li>
</ol>
<h3>Install the plugin manually (via file upload)</h3>
<ol>
<li>Download the plugin from the WordPress plugins repository</li>
<li>Unzip the zip file and upload the folder to the <code>/wp-content/plugins/</code> directory</li>
<li>Activate the Melapress Login Security plugin through the Plugins page in WordPress</li>
</ol>


Melapress Login Security

Enforce WordPress login and password security policies to protect user accounts and prevent unauthorized logins.

Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools vs Melapress Login Security