by flobamedia 0 (0 reviews)

Logliy – Login Protect (Passkey, Email, SSO)

Name: Logliy – Login Protect (Passkey, Email, SSO)
Author: flobamedia

Passwordless login with Passkeys, Email Code, Magic Link and SSO. Email access rules, shared rate limits, security log and alerts.

Logliy ranks #29,508 among WordPress.org plugins with 10+ active installations, is #662 of 1,659 in the Authentication category, and was last updated Oct 22, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v0.2.0 Current Version v0.2.0

Updated 2 weeks ago Last Update on 22 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#662 of 1,659 in Authentication Top 50% by installs Actively maintained

View on WordPress.org

Rank

#29,508

— No change

Active Installs

10+

-44.4%

KW Avg Position

76.5

0.2 worse

Downloads

491

+1 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 20

Total Progress 80%

10+ 20+

6,335

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 2 more installs to reach 20+

Rank Changes

Current #29,508

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 0.2.0
Last Updated: Oct 22, 2026
Requires WP: 6.4+
Tested Up To: 7.1.4
PHP Version: 8.1 or higher
Author: flobamedia

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Logliy – Login Protect (Passkey, Email, SSO)

On Email, under General email settings, enable the allowlist and enter one rule per line: @example.org, staff-*@example.net or person@example.org. Rules are case-insensitive. A domain rule does not include subdomains; wildcards are allowed only before @. An enabled empty list denies all email login. Rules apply to the account email even when the user enters a username. Both sending and redemption check the current rules. Passkeys and SSO have separate policies. Public request responses do not reveal whether an account is eligible.

Yes. Email challenges are stored in a dedicated database table and consumed atomically. A new request replaces the previous challenge of the same method. Codes allow at most five attempts without extending their original expiry. Changes to the account email invalidate outstanding challenges. Upgrading to 0.2.0 invalidates pending codes/links from older versions; request a new one.

On SSO, configure a separate email allowlist and/or permitted values from a signed ID-token claim such as groups, roles or realm_access.roles. At least one group must match exactly. When both restrictions are enabled, both must pass, including for existing linked accounts. Rules run before account linking or creation and never assign WordPress roles. Verified email is required by default in 0.2.0. Your provider must return boolean email_verified: true; an administrator can disable this requirement for a trusted provider that does not support the claim.

Event type, UTC time, actor/account IDs and plugin file names only. No raw IP addresses, email addresses, codes, links, user agents or tokens are recorded. IDs can still identify users; include the log in your privacy assessment. The log is enabled by default, capped at 10000 events, and retained for 30 days (configurable 1–365). Expired entries are hidden immediately; hourly WordPress cron deletes them. Administrators can inspect it on Security log. It is a local operational log, not a tamper-proof audit service.

All categories are off by default. Enable account security, plugin changes, user changes and/or Logliy settings changes on Security. Plugin installations, updates (including automatic updates), activations, deactivations and deletions each have their own notification switch. Existing all-plugin notification choices are preserved. User notifications cover creation, deletion and role changes. Account security notices cover Passkeys, SSO links, session revocation and email/password changes. Administration notices go to the configured recipient or the WordPress administration email; account notices also go to the affected account. At most 20 messages per recipient per hour are sent; failures and suppressed messages are logged. WordPress may send its own notices independently. Delivery uses wp_mail and depends on your site's mail setup.

Profiles show active sessions with individual and all-session revoke buttons. Users can manage their own sessions; administrators need permission to edit the target user. With custom session storage, only all-session revocation is supported here. Revoking the current session signs you out.

Open Settings → Logliy → SSO. Enable SSO and enter your OpenID Provider Issuer URL, Client ID, and Client Secret. Register the shown Redirect URI at the provider. The SSO tab appears on the login form only when those three fields are set. ID tokens must be signed with RS256. New WordPress users are not created unless you turn on Create users. I locked myself out Add to wp-config.php: define( 'LOGLIY_ALLOW_PASSWORD', true ); Then sign in with your password and adjust Logliy settings.

No. Logliy is the login method layer. Wordfence remains your WAF / lockout / scanner layer. Application Passwords / WP-CLI / XML-RPC Application Passwords and WP-CLI are not blocked by the password policy. With password login off, XML-RPC authentication with the account password is blocked by default (affects the WordPress mobile app, Jetpack, and some backup tools). Enable Allow XML-RPC passwords under Logliy → General if a tool still requires it. Prefer Application Passwords when the client supports them.