Failed attempts and IP access

Loginizer limits repeated login attempts by blocking an IP address after too many failures. The default is a 15-minute block after three failed attempts, followed by a 24-hour block after multiple lockouts. Administrators can change these settings. Loginizer also provides failed-attempt logs, IP blacklists and whitelists, trusted-IP restrictions, a blocked screen, custom error messages, and email notifications after successful logins.

These rules manage login attempts and the addresses allowed to reach login. Authentication settings add checks for the user’s account.

Ways to verify a user

Passwordless Login sends a temporary sign-in link to the email address associated with a username or email entered at login. Email two-factor authentication sends a temporary six-digit code after the login details are entered. Users can also set up app-based two-factor authentication with Google Authenticator, Authy, or another compatible app, add a challenge question, or sign in with a passkey.

Loginizer supports LinkedIn login. Pro social login includes Google, GitHub, Facebook, X, Discord, Twitch, LinkedIn, and Microsoft, with support for WooCommerce and Ultimate Member. Pro also includes single sign-on for temporary dashboard access without sharing a username or password, and a setting to limit concurrent logins across devices.

CAPTCHA and login paths

Administrators can configure Google reCAPTCHA v2 or v3, Cloudflare Turnstile, or hCAPTCHA for the login screen, comments, and registration forms. CAPTCHA options also support WooCommerce workflows.

Loginizer can change the login slug from wp-login.php and rename the administration path from wp-admin. Rename Login with Secrecy keeps login URLs pointing to wp-login.php; visitors must enter the new slug directly. CSRF Protection adds a session string to the administration URL, making it harder to predict. Pro also offers options to disable or rename XML-RPC and disable pingbacks.

File checks and other controls

Administrators can check permissions for important files and folders. The Pro MD5 Checksum tool checks WordPress core files and lets administrators review results and ignore files where appropriate. Other Pro settings include country blocking, username enumeration protection, automatic IP blacklisting for specified usernames, and a blacklist for new registration email domains.

Setup and support

1. Install and activate Loginizer-Security Pro in WordPress.
2. Review brute-force settings, failed-attempt logs, and IP rules.
3. Choose passwordless login, passkeys, email or app-based two-factor authentication, or a challenge question.
4. Configure CAPTCHA, WooCommerce protection, and custom login or administration paths as needed.
5. Run the core-file checksum check and review the results.

Loginizer-Security Pro includes professional support through the Premium Support Ticket System. Documentation is available for Loginizer, and free users can use community support forums.