by Saral Techies 0 (0 reviews)

Saral Login Shield

Name: Saral Login Shield
Author: Saral Techies

Two-factor login, a hidden login page and login attempt limits, plus a login activity log. Forgot the login URL? Get it by email.

Saral Login Shield ranks #71,033 among WordPress.org plugins with 0+ active installations, is #1,407 of 1,659 in the Authentication category, and was last updated Oct 20, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v2.4.0 Current Version v2.4.0

Updated 2 weeks ago Last Update on 20 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#1,407 of 1,659 in Authentication Actively maintained

View on WordPress.org

Rank

#71,033

— No change

Active Installs

-100%

KW Avg Position

N/A

— No change

Downloads

385

+5 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 10

Total Progress 0%

0+ 10+

43,465

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 10 more installs to reach 10+

Rank Changes

Current #71,033

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.4.0
Last Updated: Oct 20, 2026
Requires WP: 5.0+
Tested Up To: 7.1.4
PHP Version: 7.0 or higher
Author: Saral Techies

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

2FA hide login limit login attempts security two factor

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Saral Login Shield

Direct requests to /wp-login.php will return a 404 page (or redirect to a URL you specify). Your login form is only accessible at your custom slug.

Go to Users → Profile and scroll to Two-factor login. Install an authenticator app on your phone, add an account in the app by scanning the QR code shown (or typing the setup key), then enter the 6-digit code the app shows and click Update Profile. Save the 10 backup codes you are given. To require it for every administrator, tick Require two-factor login for administrators under Settings → Saral Login Shield.

Enter one of your backup codes instead of the 6-digit code. Each backup code works once. After logging in, set up two-factor login again on your new phone from your profile. If you have no backup codes left, another administrator can turn it off for you under Users → Edit user. If you are the only administrator, add define( 'SARALSHIELD_DISABLE_2FA', true ); to wp-config.php, log in, and remove the line once you have set it up again.

Yes, for login forms that use WordPress's own login function, such as WooCommerce's My Account page: after the password, the code prompt is shown before the login is completed. Login forms that check passwords in their own way, or that log in through AJAX without loading a new page, are not supported. My authenticator app's codes don't work. The codes depend on the time, so check that your phone's clock is set automatically. A code that has just been used can't be used again, so wait for the next one if you set up two-factor login a few seconds ago.

Go to yoursite.com/?login-recovery (or yoursite.com/your-folder/?login-recovery if WordPress is in a sub-folder) and enter the email address of an administrator account. The login URL is emailed to that address. If email isn't working on your site, deactivate the plugin by renaming its folder over FTP; this restores /wp-login.php.

Wait for the lockout to end (20 minutes by default), or log in from another network, such as your phone's mobile data, and unblock your IP address under Settings → Saral Login Shield → Login activity. Lockouts are per IP address, so other people can still log in. For IPv6, a lockout covers the visitor's /64 network, which is usually one home or office connection.

Yes. Under Settings → Saral Login Shield → Visitor IP address, choose Cloudflare or your proxy's header. Otherwise every visitor appears to come from the proxy's IP address, and one lockout would block everyone. The settings page shows the IP address it currently reads, and warns you when it detects Cloudflare. Only choose a proxy option if your site really is behind that proxy, because otherwise visitors can fake the header.

Turn it off unless something on your site needs it. Jetpack and some publishing and mobile apps use XML-RPC; most sites don't. The block editor and the REST API are not affected.

For each login, failed login, wrong two-factor code, lockout and recovery email: the time, the username entered, the IP address and the browser. For users with two-factor login, it stores their secret key (encrypted with your site's security keys) and their backup codes (hashed like passwords). Records are deleted after 30 days (you can choose 7, 30, 90 or 365 days), and everything is removed when you delete the plugin. A suggested paragraph is added to Settings → Privacy for your privacy policy. The plugin doesn't contact any outside service; emails are sent through your site's normal email.

New installs get a random login URL such as /login-k3x9qa, shown in a notice after activation and on the Settings → Saral Login Shield page. You can change it there at any time. Sites updating from 1.0.0 keep the login URL they already have.