AuthDock — Login Security, 2FA, Social Login & Brute Force Protection

These are the screens in the AuthDock menu. The setting-by-setting reference is in docs/ in the plugin's repository. 🔑 Sign-in methods Social login — Google, Facebook, GitHub, X, Apple, Microsoft, LinkedIn, Discord, Twitch and Slack, with account linking, auto-registration, a default role and email-domain restriction. Magic links — expiry, rate limiting, allowed roles, custom email copy. Single use, and dead the moment the password changes. Two-factor — TOTP or emailed codes, per-role enforcement with a grace period, trusted devices, backup codes, encrypted secrets, replay protection. Passkeys — first or second factor, verified on your own server, with clone detection. Single sign-on — any OIDC provider with a discovery document, with role mapping. SMS codes — through a gateway you connect via the authdock_send_sms filter. 🛡️ Protection Login limiter — escalating lockouts, auto-blacklisting, CIDR and wildcard allow and deny lists, XML-RPC coverage, trusted proxies, admin alerts. Bot protection — proof-of-work by default; Turnstile, hCaptcha and reCAPTCHA optional. A provider outage never becomes a login outage. Breached passwords — checked by k-anonymity, so no password and no full hash leaves your site. Location & network rules — allow or refuse by country or hosting network, per surface and per role. Hardening — custom login URL, XML-RPC control, REST API restriction, user-enumeration blocking, a password policy, six security headers. 👤 Users & access Access control — wp-admin restricted by role or IP, with an emergency bypass key. Sessions — concurrent limits, idle timeouts, per-role cookie lifetimes, remote termination. Account centre — every session, trusted device, passkey and connected account on one screen the user owns. 📋 Monitoring Audit log — every authentication event in an indexed table; filter by type, date, user or address, export to CSV or JSON, expire on your own schedule. Notifications — eight admin alerts and six user alerts, throttled, with a test send. Delivery channels — the same alerts by email, by Telegram, or both, chosen separately for administrators and account holders. Members can connect their own Telegram where a site allows it. Log streaming — HMAC-signed JSON webhooks, sent after the response has gone out. Security score — a weighted 0–100 rating, a seven-step setup walkthrough, an optional weekly digest. 🧰 Recovery & appearance Recovery — wp authdock on the command line, AUTHDOCK_SAFE_MODE, a wp-config.php constant for every control that can lock you out, and Site Health checks. Light, dark or system — chosen per person, applied on the server, scoped to AuthDock's screens.

Yes. Social login buttons appear on WooCommerce login and checkout pages when WooCommerce is active. Role-based redirects also work with WooCommerce customer roles.

Yes. Each subsite in a WordPress multisite network has independent settings and its own audit log table.

No. AuthDock uses conditional asset loading — CSS and JavaScript load only where needed. Database queries use proper indexing, and brute force tracking uses lightweight transients instead of database writes.

Cron events are cleaned up, but your settings, database tables, and user data are preserved so you can reactivate later without losing configuration.

All plugin data is completely removed: options, user meta (social IDs, 2FA secrets, trusted devices), custom database tables, capabilities, and transients.

Yes. When a user logs in via social login, they must still complete the 2FA challenge if enabled for their account or role. AuthDock ensures 2FA cannot be bypassed regardless of login method.

Any TOTP-compatible app works, including Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and FreeOTP.

AuthDock includes a recovery key parameter. Access your login page via ?authdock_recover=YOUR_KEY to bypass the custom login URL block. The recovery key is set in your security settings.

Yes. Configure trusted proxy IPs in the login limiter settings, and AuthDock will correctly read the real client IP from X-Forwarded-For headers.