Block brute-force attacks, bots, and unauthorized access. Lightweight, zero external API calls.
Guard protects your site from common login attacks. Zero external APIs, minimal server load.
Auto-lockout after a configurable number of failed login attempts.
Complete log with IP, username, status, and timestamp. Searchable and sortable.
Manually block suspicious IP addresses. Permanently or for a set duration.
Replaces "Wrong password" and "No such user" with a generic error message.
Full or partial XML-RPC blocking — the main brute-force attack vector.
Invisible field on the login form. Bots fill it — and get blocked instantly.
Guard PRO adds advanced security features for serious projects.
Block entire countries. IP detection via ip-api.com with caching.
TOTP (Google Authenticator). QR code + backup codes for each user.
Email and Telegram alerts on IP blocks, admin logins, failure thresholds.
Replace /wp-login.php with your own address. Default URL returns 404.
reCAPTCHA v3 or hCaptcha integration on the login form.
Detects credential stuffing and distributed brute-force attacks.
| Feature | Free | PRO |
|---|---|---|
| Login attempt limits | ✓ | ✓ |
| Login log | ✓ | ✓ |
| IP blacklist | ✓ | ✓ |
| Hide login errors | ✓ | ✓ |
| XML-RPC blocking | ✓ | ✓ |
| Honeypot trap | ✓ | ✓ |
| Dashboard with charts | ✓ | ✓ |
| IP whitelist | — | ✓ |
| Country blocking | — | ✓ |
| Two-factor authentication | — | ✓ |
| Email notifications | — | ✓ |
| Telegram notifications | — | ✓ |
| Custom login URL | — | ✓ |
| reCAPTCHA / hCaptcha | — | ✓ |
| Attack detector | — | ✓ |
Download Guard from the WordPress directory or install the ZIP manually.
Set attempt limits, lockout duration, and additional parameters.
Guard works automatically. Visit the dashboard to see your stats.
Guard Free does not connect to any external services. All data is stored locally in your WordPress database. IP addresses are logged solely for attack protection and are automatically deleted after a configurable period (30 days by default).
No. Guard performs one indexed DB query per login attempt. Zero external API calls.
Lockouts are temporary (30 minutes by default). To unblock early, delete the record from wp_lwg_blocked_ips via phpMyAdmin.
Yes. Guard checks CF-Connecting-IP, X-Forwarded-For, and X-Real-IP headers to detect the real visitor IP.
Yes. Go to Guard → Blocked IPs and add the address manually.
All plugins have a free version.
If they help you — consider supporting development.