Login protection

Login protection does the part of login security that actually works: an attacker guessing passwords is stopped by being unable to keep guessing, not by the form being somewhere unexpected. It is on out of the box, and its settings live on the Login tab.

Rate-limiting failed sign-ins

After enough failed attempts from the same address, further sign-ins from it are refused for a while. Each repeat from that address doubles the wait, up to a ceiling of a day. A correct password during a lockout is still refused — the lock is on the address, not the credentials.

You can set:

• How many failures are allowed before a lockout. The default is 5, and it will not go below 3.
• How long the first lockout lasts. The default is 15 minutes, and it will not go below a minute. Each repeat doubles from there.

Which address an attempt came from

This is the whole problem, and the screen makes you choose rather than guessing. REMOTE_ADDR is the only value a site can trust by default — but behind Cloudflare or any reverse proxy it is the proxy’s address, so every visitor looks like one address and a single attacker would lock out the world. A forwarded header fixes that case and breaks the other: with no proxy in front, the header is attacker-controlled, so nobody would ever be locked out. Neither default is safe for the other case, so the setting says which your site is, and the screen prompts you to change it when a forwarded header is arriving and the setting is off.

An escape hatch

You can exempt your own address so you are never locked out. The screen says plainly that this is worth having only on a fixed connection — on a changing address it would be an open door.

The form no longer names usernames

WordPress tells an attacker the difference between “unknown username” and “the password you entered is incorrect”, which hands them half the answer. Alovio Protect flattens both to a single message. Its own lockout message survives, because that is the one case where the person genuinely needs to know what happened.

Optionally blocking XML-RPC pingbacks

You can switch off XML-RPC and strip its pingback methods, which are a common lever for distributed attacks. This is off by default.

Moving the login address

Also offered, and framed honestly: this is concealment, not protection. Anyone willing to look can find the new address, so it stops nothing aimed at your site in particular. What it does do, measurably, is take the constant background of automated attempts off wp-login.php, which cuts log noise and server load. The rate limiting above is the part that stops password guessing.

The usual way this feature goes wrong is locking the owner out, so it is built not to:

• wp-login.php answers as if it does not exist. An unrecognised visitor gets the theme’s own 404 page — not a WordPress error screen, which would be a giveaway in itself.
• wp-admin answers the same way to anyone not signed in, because sending them to the login form would hand over the new address. admin-ajax.php and admin-post.php are left open — they are how plugins talk to the site, often with nobody signed in.
• The links already in the wild keep working at the old address: logging out, password resets and protected posts. Breaking those to hide a form would be a poor trade.
• The new address is emailed to the site administrator the moment you set it, so it exists somewhere other than the tab you typed it into.
• A slug that collides with a published page is refused, and an obvious guess such as login or admin is flagged. Use 3 to 40 letters, numbers and dashes, starting with a letter or number.

If you ever lose the address, one line in wp-config.php brings wp-login.php back whatever is stored in the database:

define( 'ALOVIO_LOGIN_SLUG', false );

See also

• Getting started
• FAQ