/wp-login.php is the single most attacked endpoint on the WordPress internet. Guardian Gaze closes it down with rate-limited lockouts, two-factor authentication, CAPTCHA challenges, IP whitelisting for admin paths, and a full audit trail of every authentication event.
WordPress site owners typically receive thousands of automated login attempts per month. Most are low-effort credential-stuffing scripts; a small fraction are targeted. Either way, every successful guess is a full site compromise. Login security in Guardian Gaze is layered so even if one defence fails, the next holds.
Configurable lockout threshold (default: 5 failed attempts). After the threshold, the IP is temporarily blocked from the login page. Lockout duration is automatic and enforced per-IP.
TOTP-based 2FA compatible with Google Authenticator, Authy, 1Password and any other TOTP app. Enrolment is per-user; you can require it on admin accounts only or sitewide.
reCAPTCHA v2 or v3 on login, registration and password-reset forms. Stops the automated credential-stuffing scripts that don't bother to solve human challenges.
Every successful and failed authentication event is logged, IP, user-agent, account, timestamp, outcome. Searchable from the Guardian Gaze dashboard.
When an IP crosses the failed-attempt threshold, it loses access to the login page, not to your whole site. Visitors and customers continue browsing normally; only the attacker's path is closed. After the block window expires, the IP regains access automatically, with the failed-attempt counter reset.
For higher-stakes sites, you can restrict the WordPress admin login to a specific set of trusted IPs. Anyone else hitting /wp-login.php or /wp-admin/from an unauthorised IP gets a hard rejection; they can't even attempt a login. Whitelisted IPs bypass the failed-attempt lockout rules and continue to log in normally.
IP whitelist + 2FA together is the configuration most security-conscious site owners eventually arrive at. The whitelist stops most automated traffic at the door; 2FA is the second factor in case credentials leak. Both together is significantly stronger than either alone.
Site-wide policy: optional · required for administrators · required for all users.
QR code scan with any TOTP app. Backup codes generated for account recovery.
Code refreshes every 30 seconds. Required on every authentication; remember-this-device option for trusted browsers.
Lost phone? Use a one-time backup code. Or have an admin reset 2FA via the user-management screen.
The authentication audit trail is critical for incident response. If something does go wrong, you can see exactly when, from where, and which account was the entry point.
| Capability | Free | Pro | Agency |
|---|---|---|---|
| Brute-force lockout | ✓ | ✓ | ✓ |
| Two-factor authentication (TOTP) | ✓ | ✓ | ✓ |
| CAPTCHA on login & registration | ✓ | ✓ | ✓ |
| Audit trail (last 30 days) | ✓ | ✓ | ✓ |
| Full audit history | ✗ | ✓ | ✓ |
| IP whitelisting for admin | ✓ | ✓ | ✓ |
| Country-level login blocking | ✗ | ✓ | ✓ |
| IP reputation feed (block known-bad IPs) | ✗ | ✓ | ✓ |
Most sites see a 90%+ reduction in login-related events within the first 24 hours of enabling Guardian Gaze.