Login protection

Signocore Toolkit blocks IP addresses that keep guessing passwords and can move the login page to an address only you know. Both live on Signocore Toolkit → Security. Login protection is on from the start; the hidden login page is off until you set it up.

Limit login attempts

The settings are in the Login Protection card. Change what you need and click Save Changes.

How blocking works

• Failed logins are counted per IP address, from the first failed attempt until the attempt window ends. After that, the count starts over.
• When the count reaches the limit, the address is blocked for the block duration. Every login from it fails with a message such as "Too many failed login attempts. Please try again in 30 minutes.", even with the right password. Attempts during a block do not extend it.
• A successful login does not reset the count. Otherwise someone with a valid account could mix real logins with guesses at another account and never be blocked.
• Failed logins count wherever WordPress checks a password, such as the login page and the WooCommerce account login.

Whether login protection is on or off, a failed login shows one message, "Invalid login credentials.", instead of saying whether the username or the password was wrong. That keeps attackers from finding out which usernames exist.

The Login Protection card on the Overview tab shows how many addresses are blocked right now. When the activity log is on, blocks and failed logins also appear there, see Developer tools.

Note: On sites with a persistent object cache such as Redis, the count on the Overview tab shows 0 even while addresses are blocked. The blocks themselves work as usual.

Email notifications

With Email Notifications on, the Toolkit emails the Administration Email Address from Settings → General each time it blocks an address. The email names the IP address, the last username tried and when the block ends, with a link to the settings.

Trusted IP addresses

Add your office or home address under Trusted IP Addresses so you cannot lock yourself out. Trusted addresses are never blocked, and their failed logins are not counted.

• Enter one address per line. Commas work too.
• Single IPv4 and IPv6 addresses and CIDR ranges such as 203.0.113.0/24 are accepted.
• Entries that are not valid addresses are removed when you save.

The Your IP Address box at the bottom of the card shows the address the Toolkit sees for you right now, and the header it read it from.

Note: Many internet providers change home IP addresses from time to time. If you get blocked from an address you trusted, check the Your IP Address box and update the list.

IP detection behind Cloudflare or a proxy

Behind Cloudflare, a load balancer or a reverse proxy, every request reaches WordPress from the proxy's address. If the Toolkit counted that address, all visitors would share one IP, and a single attacker could block everyone. IP Detection decides where the real address comes from:

The Your IP Address box warns you when a request carries a proxy header that the current setting ignores, and when a production site sees only a private network address. Both suggest that you should pick the header your proxy uses.

Important: Only choose one of the header options when every request passes through that proxy. A visitor who reaches the server directly can send the header with any address in it, and so avoid a block or pose as a trusted address.

The same detection is used for the allowed IP addresses in maintenance mode and for the activity log.

Hide the login page

By default, WordPress answers at /wp-login.php and sends visitors from /wp-admin/, /login and /admin to the login page, so bots always know where to knock. The Login card moves the login page to an address you choose.

1. Go to Signocore Toolkit → Security.
2. In the Login card, turn on Hide Login Page.
3. Enter a Login Slug. The default is login, which gives https://example.com/login/. Choose something less obvious.
4. Click Save Changes, and bookmark the new address: your site address followed by the slug.

Whether the address ends with a slash follows your permalink settings. With plain permalinks, the address becomes https://example.com/?your-slug=1, with any hyphens in the slug turned into underscores.

Once the setting is on:

• /wp-login.php shows your theme's 404 page, whatever is added to the address.
• /wp-admin/ shows the 404 page to visitors who are not logged in.
• /login, /admin and /dashboard no longer redirect to the login page, unless one of them is your slug.
• Login links, password reset emails and new user emails from WordPress use the new address.
• The password form on protected posts, privacy request confirmation links and forms that post to admin-post.php keep working.

WordPress reserves some words for its own addresses, such as search, page, author, feed, wp-admin and wp-json, and the login page cannot work at them. When you save one of these as the slug, or the slug of an existing page, the Toolkit keeps your previous slug and shows an error that names the problem. Pick a slug that no post uses either, because the login page takes over that address.

If a slug saved before this check is a reserved word, a notice asks for a different slug. Change it before you log out.

To turn the hidden login page off without logging in, add this line to wp-config.php:

define('SCTK_HIDE_LOGIN', false);

/wp-login.php then works again while the setting stays saved. Remove the line to hide the login page again.

Get back in

Blocked after failed logins

Try these in order:

1. Wait until the block duration has passed, 30 minutes by default.

2. Log in from another network, for example a phone on mobile data. Blocks apply to one IP address.

3. Turn login protection off in wp-config.php. With your hosting's file manager or FTP, add this line above the line that says That's all, stop editing!:

   define('SCTK_LOGIN_PROTECTION', false);
   

   Log in, add your address under Trusted IP Addresses, and remove the line again. While it is in place, no address is counted or blocked.

4. Ask another administrator to deactivate and then activate Signocore Toolkit on the Plugins screen. Deactivating clears all current blocks, unless the site keeps its cache in a persistent object cache. With WP-CLI, run wp plugin deactivate signocore-toolkit followed by wp plugin activate signocore-toolkit.

Forgot the login address

1. If you are still logged in somewhere, the address is next to Login Slug on Signocore Toolkit → Security.
2. Look for a password reset or new user email from the site. Its login link uses the custom address.
3. Add define('SCTK_HIDE_LOGIN', false); to wp-config.php with your hosting's file manager or FTP, above the line that says That's all, stop editing!. Log in at /wp-login.php, read the slug on the Security tab, and remove the line again.
4. With WP-CLI, run wp plugin deactivate signocore-toolkit, log in at /wp-login.php, activate the plugin again and read the slug on the Security tab. Your settings are kept.
5. Without WP-CLI, rename the folder wp-content/plugins/signocore-toolkit with your hosting's file manager or FTP, for example to signocore-toolkit-off. Log in at /wp-login.php, rename the folder back, and activate the plugin again on the Plugins screen if WordPress has deactivated it. Then read the slug on the Security tab.

Note: The SCTK_LOGIN_PROTECTION constant only turns off login protection. To bring back /wp-login.php when the login page is hidden, use SCTK_HIDE_LOGIN.

For other login problems, see Troubleshooting.