Antispam Login Form

Antispam Login Form keeps bots out of your WordPress site with a friendly math question that real people solve in a second – and with invisible traps and login lockouts that stop attacks before they start. No accounts, no API keys, no Google reCAPTCHA, no tracking of your visitors. Everything runs on your own server.

🎨 Your site is secure – now make it stunning! Antispam Login Form is made by SEOS Themes – beautiful, lightweight WordPress themes built for speed and SEO. 👉 Browse SEOS Themes now or try our free themes on WordPress.org.

🔐 Secure math CAPTCHA

• Signed, single-use, expiring questions. The correct answer is never sent to the browser. Every question is signed with your site's secret keys, works only once and expires – bots cannot read, change or replay it.
• 3 question types: addition (classic), mixed (+ − ×) and words ("seven plus three").
• 3 difficulty levels – easy, medium and hard.
• Image mode – show the question as a picture with noise to stop bots that read page text.
• 3 styles (boxed, minimal, inline), your own accent color, label, placeholder and error message.

🪤 Invisible bot traps

• Honeypot – a hidden field that only bots fill in.
• Time trap – blocks forms sent faster than a human can type.
• JavaScript check (optional).

📝 Protects every form

• WordPress login (wp-login.php and wp_login_form())
• Registration
• Lost password (no more reset e-mail floods)
• Comments (visitors only)
• WooCommerce My Account login, registration and lost password (also the checkout login)
• Multisite signup

🛡️ Brute-force protection

• Lock out IPs after too many failed logins (you choose attempts, time window and duration).
• Long lockouts for IPs that keep coming back.
• Works for wp-login.php, WooCommerce, XML-RPC – every login.
• Shows remaining attempts to real users.
• E-mail alerts when an IP is locked out.
• See and unlock active lockouts with one click.

🌐 IP allow & block lists

• Single IPs, CIDR ranges (IPv4 and IPv6) and wildcards.
• "Add my IP to the allow list" button so you never lock yourself out.
• Works behind Cloudflare, proxies and load balancers.

🧱 Hardening

• Generic login errors – attackers can't find out which usernames exist.
• Block user enumeration – ?author=1 scans, REST API users endpoint, users sitemap, oEmbed.
• XML-RPC control – allow, block password logins only, or switch off completely.
• Disable application passwords, hide the WordPress version.

📊 Dashboard, log & tools

• Statistics, 7-day chart, top attack reasons and a protection score with one-click "Turn on recommended protection".
• Activity log with CSV export.
• WordPress dashboard widget.
• Export / import settings between sites, reset to defaults.
• Emergency switch: define( 'ALF_DISABLE', true ); in wp-config.php.
• Developer filters and actions, translation ready.

⭐ More from SEOS Themes Looking for a theme that is as fast and clean as this plugin?

• 🚀 Fast-loading, SEO-friendly code
• 📱 Fully responsive on every device
• 🎛️ Easy setup – no coding needed
• 🤝 Made by the author of this plugin

➡ Discover SEOS Themes · Free themes on WordPress.org · Plugin home page

Install via Plugins > Add New

1. Search for "Antispam Login Form"
2. Click "Install Now"
3. Click "Activate"
4. Open Antispam Login in the admin menu. The recommended protection is already on.

Via ZIP / FTP

1. Unzip the ZIP file and upload the antispam-login-form folder to wp-content/plugins.
2. Activate the plugin through the 'Plugins' menu in WordPress.

2.0.0

• Security: the answer is no longer sent in the form. Questions are now signed (HMAC with your site salts), single-use, bound to the form and time-limited.
• Security: the login check no longer breaks XML-RPC / app logins and only runs on the login form.
• New: brute-force lockouts with long lockouts, remaining attempts, e-mail alerts and unlock buttons.
• New: CAPTCHA for lost password, comments, WooCommerce (login, register, lost password), multisite signup and wp_login_form().
• New: honeypot, time trap and optional JavaScript check.
• New: mixed and word questions, 3 difficulty levels, image mode, 3 styles, accent color, custom texts.
• New: IP allow / block lists with CIDR (IPv4 + IPv6) and wildcards; Cloudflare / proxy IP detection.
• New: generic login errors, user enumeration blocking, XML-RPC control, disable application passwords, hide WordPress version.
• New: dashboard with statistics and protection score, activity log with CSV export, dashboard widget.
• New: export / import / reset settings, emergency switch ALF_DISABLE, uninstall cleanup (optional).
• Fix: translations now load with the correct text domain.
• Fix: admin CSS loads only on the plugin pages.
• Fully backward compatible – sites updating from 1.0 keep the same behaviour until new features are turned on.

1.0

• Initial release of plugin