SiteGuard Security – a free, open-source WordPress plugin I built to protect wp-admin logins: brute-force lockout, login logs, IP lists, CAPTCHA and two-factor authentication, downloadable straight from GitHub.
SiteGuard Security is a free WordPress login security plugin I designed, built and maintain. It covers brute-force lockout, login logs, IP whitelist and blacklist, custom login errors, CAPTCHA and two-factor authentication in one plugin. No account, no upsell, and no external service except the CAPTCHA provider you choose.
Why I built it
Login attacks hit every WordPress site I build and maintain, and protecting them usually means stacking a lockout plugin, a CAPTCHA plugin and a 2FA plugin, often with a paid tier or an outside account. SiteGuard puts the login protection I actually need into one lightweight plugin I can install on every client site and update from one place.
What it does
- Brute-force lockout: per-IP max retries, lockout minutes, an extended lockout after repeated lockouts and auto reset. Counters are atomic, so they stay correct with many PHP workers, and application-password failures over REST and XML-RPC are counted too. Optional admin email on lockout.
- Login log: successful, failed, locked-out, blocked, CAPTCHA-failed and 2FA-failed logins, backup-code use and email failures, with filter, search, CSV export and daily pruning in batches.
- IP whitelist and blacklist: single IP, range, CIDR and IPv6; the whitelist wins. Cloudflare and proxy headers are only trusted from Cloudflare ranges or proxies you configure.
- Custom messages: a generic “username or password incorrect” error, attempts left, locked-out and blacklisted messages.
- CAPTCHA: Google reCAPTCHA v2 / v3 or Cloudflare Turnstile on wp-login (login, register, lost password), WooCommerce (login, register, lost password, checkout login) and comments. Programmatic logins by other plugins are never blocked.
- Two-factor authentication: authenticator app (TOTP with QR set-up), email code and 10 one-time backup codes, required per role, with in-login enrollment and an admin reset for lost phones. It covers wp-login, WooCommerce, AJAX login forms, the session-expired login and SSO / social / magic-link plugins.
How it is built
- Plain PHP classes per feature (brute force, IP, CAPTCHA, TOTP, two-factor, updater) with its own log and IP tables.
- XML-RPC password logins are refused for 2FA users while application passwords keep working.
- Multisite: per-site settings, tables and cron, with network activation and new sites handled.
- Emergency off switch:
define( 'SITEGUARD_DISABLE', true ); in wp-config.php, or rename the plugin folder, stops every login check and keeps the settings.
- Updates from GitHub Releases inside wp-admin (checked every 6 hours), no token needed. Every release is linted on PHP 7.4 to 8.4 before it is built.
- Requires WordPress 6.0+ and PHP 7.4+, tested up to WordPress 7.1. GPLv2 or later.
Install
Download siteguard-security.zip from the latest GitHub release (currently version 1.0.3), then go to Plugins > Add New > Upload Plugin, activate it and open the SiteGuard menu. Deleting the plugin from wp-admin removes all of its data (log and IP tables, settings and users’ 2FA set-up), so back up your database first if you may want them back.
Need something custom?
I build custom WordPress plugins and harden WordPress sites for businesses in Malaysia. Tell me about your site.
