Free brute-force controls and IP rules
Loginizer’s free controls apply escalating limits to failed logins and let administrators manage which IPs can reach the login screen.
By default, an IP is blocked for 15 minutes after three failed attempts, with a 24-hour lockout after repeated lockouts. Administrators can review failed-login logs, blacklist or whitelist individual IPs and ranges, and restrict login access to trusted IPs. Email alerts can report successful logins or maximum lockouts, while customizable messages can change the failed-login notice. These settings give site owners a practical starting point for limiting repeated attempts and reviewing suspicious activity.
Premium login verification and account access
Premium adds multiple ways to verify users and manage how they access accounts.
- Passwordless login: Send a temporary login link to the account’s email address.
- Two-factor authentication: Require a temporary email code or verification through an authenticator app.
- Challenge questions: Ask users to answer a configured question after logging in.
- Single sign-on: Let users access the WordPress dashboard without sharing their username or password.
- Social login: Support sign-in or registration through services including Google, GitHub, Facebook, X, Discord, Twitch, LinkedIn and Microsoft.
- Concurrent-login limits: Set how many devices may be logged in at once and what happens when the limit is reached.
- LinkedIn login: LinkedIn login is also included in Loginizer’s free feature list.
Sites seeking stronger account verification can consider the premium options; social login has a broader range of providers there.
Premium bot and WordPress access hardening
Premium also includes controls for automated traffic, login routes and several WordPress access points.
- CAPTCHA: Choose reCAPTCHA v2 or v3, Cloudflare Turnstile or hCAPTCHA for login, comments and registration forms, including WooCommerce.
- URL changes: Rename the login page and admin URL, or require users to enter the renamed login address directly.
- CSRF protection: Add a session string to the admin URL to make it harder to predict.
- XML-RPC and pingbacks: Disable XML-RPC or rename its URL, and disable pingbacks.
- Username-based blocking: Automatically blacklist IPs that attempt configured usernames commonly targeted by attackers.
- Country blocking: Restrict access from selected countries.
- User-enumeration protection: Block unauthenticated access to common username paths.
- Registration-domain blocking: Prevent new registrations using specified email domains.
- Admin username changes: Rename the admin username.
- Core-file checks: Compare WordPress core files against MD5 checksums, with options to check and ignore files.
These controls suit administrators who need more than failed-login limits, but they require choosing which access restrictions fit the site’s users and workflows.
Recent updates, but limited support resolution data
Loginizer is current, while its small support-thread sample makes the resolution rate a limited signal on its own.
The latest version is 2.1.3, updated within the last week. Support data reports four threads, with one quarter marked resolved; that low share warrants caution because the number of threads is small. The plugin is among the directory’s most widely installed, and its ratings are described as excellent. For prospective users, the update and broad adoption are positive signals, while support responsiveness is harder to judge from this thread count.
