by
wordpressdirect
5 (4 reviews)
Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
Stop brute force attacks for free. Limit login attempts, add 2FA and reCAPTCHA, hide wp-login.php, block IPs and see every login on your site.
Admin Safety Guard ranks #26,978 among WordPress.org plugins with 20+ active installations, is #596 of 1,659 in the Authentication category, a 5/5 rating from 4 reviews, and was last updated Aug 13, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Tested up to WP 7.0.8 (Current: 7.1.4)
v1.4.1
Current Version v1.4.1
Updated 2 months ago
Last Update on 13 Aug, 2026
Refreshed 1 week ago
Last Refreshed on
#596 of 1,659 in Authentication
Top 50% by installs
Rank
#26,978
—
No change
Active Installs
20+
-13%
KW Avg Position
106.5
—
No change
Downloads
3K
+7 today
Support Resolved
0%
—
No change
Rating
100%
Review 5 out of 5
5
(4 reviews)
Next Milestone 30
20+
30+
4,233
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 2 more installs to reach 30+
Rank Changes
Current
#26,978
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
4 reviews
Overall
100%
5
4
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.4.1
- Last Updated
- Aug 13, 2026
- Requires WP
- 5.8+
- Tested Up To
- 7.0.8
- PHP Version
- 8.0 or higher
- Author
- wordpressdirect
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 4
- Support Threads
- 0
- Resolved
- 0%
Keywords
brute force protection
custom login url
limit login attempts
login security
two factor authentication
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
5M+ installs
#9
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
Loginizer
1M+ installs
#46
All-In-One Security (AIOS) – Security and Firewall
1M+ installs
#57
Maintenance
1M+ installs
#59
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
700K+ installs
#86
Frequently Asked Questions
Common questions about Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
Yes. Everything listed under Free Features works with no limits, no trial period and no account. Pro exists for magic links, app-based 2FA, social login, password policies and the web application firewall, but nothing in the free version is crippled to push you towards it.
No. The admin JavaScript and CSS only load on the plugin's own screens, and even there only the bundle for the screen you're viewing. Your front end gets nothing extra. The login checks themselves are a couple of indexed database queries.
That's the risk worth taking seriously, so two things protect you. Add your own IP to the trusted list and login limiting will never apply to you. And if you change your login URL, bookmark the new address before saving, because wp-login.php will return a 404 afterwards. If it does happen: wait out the lockout (15 minutes by default), or rename the plugin folder over FTP to switch everything off.
Each failed password is recorded against the IP address it came from. Hit your limit (3 by default) and that address is locked out for your chosen duration (15 minutes by default). If the same address collects several lockouts in a day, it's blocked for a full 24 hours. Trusted addresses are skipped entirely, and everything is logged.
Per-IP limiting stops the overwhelming majority of automated attacks, because most run from a small number of addresses. For anything more determined, a custom login URL is the stronger layer: a bot that can't find the login form has nothing to attack. Running both is the usual answer.
The plugin points your new slug at the WordPress login system and makes wp-login.php and wp-register.php return 404 for logged-out visitors. Slugs that would collide with a real WordPress path are rejected. Permalinks are flushed automatically when you save.
Yes. Paths are resolved relative to the site's own home path, so root installs, WordPress in a subfolder, and both subdomain and subdirectory networks all behave the same.
Only the roles you choose. Leave the role list empty to cover everyone, or tick just Administrator and Editor so sign-in stays simple for customers and subscribers.
Yes. Edit the subject and the body in the Two-Factor Authentication settings. Use {otp} where the code should appear and {site_name} for your site name. Leave the body empty to use the styled default.
It controls how long a signed-in session stays valid, and every part of it is off until you turn it on. The idle timeout is the one most sites want: 30 to 60 minutes. Tying a session to an IP address is the strict option - it stops stolen cookies working elsewhere, but it will sign out anyone on a mobile connection whose IP changes, so it suits fixed office networks best.
