by Themepaste
5 (4 reviews)
Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
Protect your WP site from hackers for free. Limit logins, add 2FA, reCAPTCHA, block IPs, hide wp-login.php & track activity logs.
Tested up to WP 6.9 (Current: 7.0.1)
v1.3.0
Current Version v1.3.0
Updated 1 month ago
Last Update on 17 Jun, 2026
Refreshed 7 hours ago
Last Refreshed on
Rank
#24,841
—
No change
Active Installs
20+
-33.3%
KW Avg Position
74.7
+10.7 better
Downloads
1.6K
+12 today
Support Resolved
0%
—
No change
Rating
100%
Review 5 out of 5
5
(4 reviews)
Next Milestone 30
20+
30+
8,387
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 4 more installs to reach 30+
Rank Changes
Current
#24,841
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
4 reviews
Overall
100%
5
4
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Tracked Keywords
Showing 3 of 3| Keyword | Position | Change | Type | Updated |
|---|---|---|---|---|
| limit login attempts | 71 | — | Tag | 1 day ago |
| brute force protection | 75 | — | Tag | 1 day ago |
| two factor authentication | 78 | — | Tag | 1 day ago |
Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.3.0
- Last Updated
- Jun 17, 2026
- Requires WP
- 5.8+
- Tested Up To
- 6.9
- PHP Version
- 7.0 or higher
- Author
- Themepaste
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 4
- Support Threads
- 0
- Resolved
- 0%
Keywords
brute force protection
custom login url
limit login attempts
login security
two factor authentication
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
7K+ installs
#2,739
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
30K+ installs
#989
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
5M+ installs
#9
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
WPS Hide Login
2M+ installs
#27
Frequently Asked Questions
Common questions about Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
A: Yes. All features listed under "Free Features" above are completely free with no usage limits or hidden costs. A Pro version is available for advanced features such as magic link login, mobile app 2FA, social login, and malware scanning.
A: No. Admin Safety Guard only loads its JavaScript and CSS assets on the plugin’s own settings pages inside the admin area. It adds zero weight to your site’s front-end pages. Security checks (like login attempt limits and custom URL routing) are handled in PHP with minimal overhead.
A: The plugin sets a custom rewrite rule that points your new login slug (e.g. /my-login) to the WordPress login system. The old wp-login.php URL will redirect visitors away. Your existing bookmarks will need to be updated to the new URL. The plugin flushes WordPress permalink rules automatically when you save the setting.
A: Yes. The plugin detects subdirectory installs and builds the correct URL for your setup automatically.
A: Every time a user enters the wrong password, the plugin records the attempt against that IP address. Once the number of failed attempts reaches your configured limit (default: 3), that IP address is locked out for the duration you set (default: 15 minutes). After the lockout period, they can try again. You can also manually block IP addresses permanently from the IP Blocking settings.
A: Limit Login Attempts blocks on a per-IP basis, which stops the vast majority of automated attacks. For more sophisticated threats, enabling a custom login URL so bots cannot even find your login page adds a second layer of defence.
A: No. You enable the OTP via Email toggle in the Two-Factor Authentication settings. Once enabled, it applies to all login attempts on your site. If you want role-specific or user-specific control, that is available in the Pro version.
A: Yes. In the Two-Factor Authentication settings you can edit both the email subject line and the email body. Use the {otp} placeholder where you want the code to appear, and {site_name} for your site’s name.
A: XML-RPC is an older interface that lets external apps communicate with WordPress. It is frequently used in brute-force and DDoS amplification attacks because it allows multiple login attempts in a single request. Disabling it is safe for most sites. The only time you need XML-RPC is if you use the official WordPress mobile app for publishing, or a specific third-party service that requires it. Check with your tools before disabling.
A: It depends on your preference. reCAPTCHA v2 shows a visible checkbox ("I’m not a robot") which users must tick — straightforward and clear. reCAPTCHA v3 is invisible and runs silently in the background, scoring visitors based on behaviour. v3 offers a better user experience but requires you to set a score threshold. Both are fully supported.