by Jaime Alnassim 0 (0 reviews)

Nahnu Login Shield

Name: Nahnu Login Shield
Author: Jaime Alnassim

Hyperfocused login security. CAPTCHA, brute-force lockout, geo-blocking, 2FA, honeypot, and edge WAF — all from one screen. 100% free.

Nahnu Login Shield ranks #25,991 among WordPress.org plugins with 20+ active installations, is #1,033 of 2,958 in the Discussion & Community category, and was last updated Oct 20, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v1.0.15 Current Version v1.0.15

Updated 2 weeks ago Last Update on 20 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#1,033 of 2,958 in Discussion & Community Top 50% by installs Actively maintained

View on WordPress.org

Rank

#25,991

— No change

Active Installs

20+

— No change

KW Avg Position

119

— No change

Downloads

418

+2 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 30

Total Progress 80%

20+ 30+

3,246

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 2 more installs to reach 30+

Rank Changes

Current #25,991

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.15
Last Updated: Oct 20, 2026
Requires WP: 6.2+
Tested Up To: 7.1.4
PHP Version: 8.3 or higher
Author: Jaime Alnassim

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

Brute Force captcha geo blocking login security two factor

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

Akismet Anti-spam: Spam Protection

5M+ installs

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Jetpack – AI Agents & MCP, Security, Backup & Analytics

WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

View all Discussion-and-community plugins

Frequently Asked Questions

Common questions about Nahnu Login Shield

No. OOPSpam is one of seven CAPTCHA provider options. All other providers and all other features work independently.

No. Assets load only on wp-login.php and any pages you opt into via the Integrations tab. The JS check uses a tiny inline script with no external request. Geo lookups from CDN headers are zero-latency. API fallback results are cached per IP for a configurable period. If you opt in to the early-block mu-plugin, it turns away locked-out IPs before WordPress fully loads.

All providers fail open. A network or API error never locks out legitimate users.

It hooks specifically into WordPress login actions and standard WooCommerce and form-plugin hooks. If another plugin hooks the same actions it may conflict. Open a support thread with details if you see an issue.

Yes. Set the provider to None. Geo-blocking, brute-force lockout, honeypot username trapping, the JS presence check, and 2FA all work independently of CAPTCHA.

Yes. The WooCommerce My Account login, registration, lost-password, checkout, and order-tracking forms each have their own toggle in the WooCommerce section of the Integrations tab.

Two options. First, add define( 'NAHNLS_BYPASS_IP', 'your.ip.address' ); to wp-config.php (above the "That's all, stop editing" line). It accepts a comma-separated list of IPs and CIDR ranges, and exempts them from lockouts, the IP blocklist, geo blocking and the early-block rate limit - no deactivation needed. Second, rename the plugin folder from nahnu-login-shield to _nahnu-login-shield via SFTP, which deactivates it. If you are stuck at the two-factor step instead, see the next question.

Yes, and it is a good idea: usernames are public (author pages, feeds, the REST API), so bots try them. Add your username to the Honeypot list on the Lockout tab and sign in with your email address from then on. Anyone who tries the username is locked out like a bot. Email addresses of real accounts are never blocked, so patterns like admin@* do not affect your own sign-in. The Lockout tab lists which entries are real accounts and reminds you if your own username is on the list. If you get locked out anyway, add define( 'NAHNLS_DISABLE_HONEYPOT', true ); to wp-config.php (above the "That's all, stop editing" line) to switch the honeypot list off, sign in, fix the list, then remove the line. To clear an IP that is already locked, also see the question above. I can't receive the 2FA email / I'm locked out When two-factor authentication is on, every sign-in asks for a code, and email codes are the baseline. If the email does not arrive (a mail problem on the server, spam filtering), first try a backup code or "Email me a code" again. If that does not help, add define( 'NAHNLS_DISABLE_2FA', true ); to wp-config.php (above the "That's all, stop editing" line). This switches the 2FA check off for everyone, so you can sign in with just your password; the plugin's settings page shows a notice while it is set. Fix email delivery (an SMTP plugin usually does it), add an authenticator app on your Login & security page so you are not dependent on email, then remove the line. Note: NAHNLS_BYPASS_IP does NOT bypass 2FA - it only exempts addresses from lockouts, the IP blocklist, geo blocking and the early-block rate limit.

Mostly yes. Every protected form carries a hidden security token that lives about a day. On page load the plugin's small script fetches a fresh token (one request to admin-ajax.php), so pages served from a full-page cache keep working as long as JavaScript runs - including cached blog posts with a comment form. Without JavaScript, a cached copy of the form older than a day fails the security check and asks the visitor to reload. Login, registration and My Account pages should still be excluded from full-page caching (WooCommerce requires this anyway). Developers can lengthen the token life with the nahnls_form_nonce_life filter.

It is not tested on multisite and is not recommended for network activation.