LynBro Plugins
/ Login Guard
LynBro Plugins
/ Login Guard
Every plugin that hides wp-login.php has the same support thread: “I changed the address and now I cannot get in.” This one is built around the answer to that. The address is on screen and in your inbox, WP-CLI prints it, and one line in wp-config.php switches every guard off without losing a setting.
Free forever. No account, no card, no quota. Makes no external requests of any kind.
independent ways back into your own site, so a hidden login can never become a locked door.
wp lynbro-login-guard url prints it. wp lynbro-login-guard off puts the page back.define( ‘LYNBRO_LOGIN_GUARD_DISABLE’, true ); — every guard off, not one setting lost.The most common failure of a custom login URL is an address something else already owns. Before the address is saved it is checked against your pages, posts, categories and tags — and a bad one is refused with the reason, keeping the address that was working.
Unlocking a password-protected post, WordPress recovery mode after a fatal error, admin-ajax, admin-post, cron, WP-CLI and the REST API all keep working. So does the sign-in page for anybody already signed in — hiding your own log-out button helps nobody.
Repeat offenders wait longer each time, up to a ceiling you set. There is no permanent ban here and there is not going to be one: a plugin that can put you outside your own site forever has stopped being a security tool.
No "Pro" tier, no nag screens. The features other plugins paywall are here from day one.
wp-login.php stops showing the form. Visitors who ask for it get your theme’s 404, the front page, or an address you choose.
One keyed on the address catches a machine working through passwords. One keyed on the username catches a spray from a hundred addresses — which the first cannot see.
Standard time-based codes, checked after the password. Ten single-use recovery codes, and an administrator can switch it off for somebody who lost both.
Most plugins post your shared secret to an outside chart service to get a picture back. This one draws the code in PHP, on your server.
The same message whether the username or the password was wrong. The lost-password form stops confirming addresses. /?author=1 stops handing over a username.
“8 failed sign-ins from this address in 15 minutes, so it is held out for 20” — with a button that lets them back in and forgets the failures.
Addresses and CIDR ranges you list are skipped entirely, so one bad afternoon cannot lock out the whole team.
Uses only what your server already knows — Cloudflare, a CDN, mod_geoip. No bundled address database, no lookup service, and it says so plainly when there is no signal.
The two plugins most WordPress sites reach for when the login page is the problem.
| Feature | Lynbro Login Guard | WPS Hide Login | Wordfence free |
|---|---|---|---|
| A way back in that is not FTP | ✓ | — | ✓ |
| Login address checked against your content before saving | ✓ | — | — |
| Failed sign-ins limited by address | ✓ | — | ✓ |
| Failed sign-ins limited by username as well | ✓ | — | — |
| Two-factor with an authenticator app | ✓ | — | — |
| QR code generated on your own server | ✓ | — | — |
| Every refusal recorded with the reason | ✓ | — | ✓ |
| Undo a lockout in one click | ✓ | — | ✓ |
| No external service and no account | ✓ | ✓ | — |
| Does one job, without a scanner or a firewall | ✓ | ✓ | — |
It is e-mailed to your site’s administration address whenever it changes, and shown in full on the plugin’s own screen. wp lynbro-login-guard url prints it. And adding define( ‘LYNBRO_LOGIN_GUARD_DISABLE’, true ); to wp-config.php puts the page back at wp-login.php without deleting anything. So does deactivating the plugin.
It stops the automated traffic, which is most of it, and that alone quietens your logs and your server. It is not a lock: anybody who learns the address can still knock. The attempt limit and two-factor are what stop somebody who is actually trying — and the settings screen says exactly that, rather than selling you obscurity as security.
Yes. The sign-in page and the 404 that replaced the old address are both sent with no-store headers and the constants the common page caches look for, so neither is ever served from a cache to the wrong person.
Only briefly, and only if you want it to. Every lockout expires, you can list your own address so it is never limited, and any lockout can be lifted from the journal in a click or with wp lynbro-login-guard unblock.
Any administrator can switch two-factor off for that account from the user’s profile screen. It is recorded in the journal with the name of whoever did it.
Yes, and they do not repeat each other. Anti-Spam scores what gets posted to the sign-in form; Login Guard handles the address, the attempt limits and two-factor, and passes Anti-Spam what it knows about failed sign-ins from each address so both logs name the same reason.