Phantom User Lockout
| 开发者 | efraing |
|---|---|
| 更新时间 | 2026年9月30日 01:24 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- The time, in site time with UTC on hover
- The username and the password that was tried
- The IP address, shown as IP Blocked, Not blocked or Safe
- Where the IP is: city, region and country
- Who owns it: the hosting company or network (for example "AS53667 FranTech Solutions") and the reverse hostname
- How the attempt came in: the login form, XML-RPC (every guess inside a system.multicall batch gets its own row), REST API application passwords, or another login form
- The user agent and the requested URL
- An IP is blocked after its first attempt with a username that doesn't exist. You can raise that threshold.
- Blocks are permanent. They only lift when you press Unblock.
- A blocked visitor gets a 403 page that reads "IP Blocked".
- By default a block covers the login page, XML-RPC, REST logins and any other form that logs in through WordPress. You can widen it to the whole site.
- Optionally, the plugin can also block IPs that enter the wrong password for a real username. This is off by default, and the default threshold is 3 wrong passwords.
- Real accounts are never recorded unless you turn on the real-account option, and even then their passwords are never stored.
- If a username is within two letters of a real login or email, it's treated as a typo by one of your own people. It's logged with the password hidden and never causes a block.
- Safe IPs are never recorded or blocked. Add yours with one click: "Add my current IP address to the list".
- A signed-in administrator is never blocked. Neither are the server's own address and loopback.
- Emergency switch: add
define( 'BOTLO_DISABLE', true );to wp-config.php.
安装:
- Upload the plugin through Plugins → Add New → Upload Plugin, or install it from the directory.
- Activate it.
- Open Phantom User Lockout in the admin menu, go to Blocked & Safe IPs and click Add my current IP address to the list. Do the same from every place you or your staff log in.
- If your site is behind a proxy or CDN and every visitor shows the same IP, change Visitor IP comes from in Settings.
常见问题:
I locked myself out.
Add define( 'BOTLO_DISABLE', true ); to wp-config.php, or rename the plugin's folder over FTP. Then log in, unblock your IP, add it to Safe IPs, and remove the line.
Why record the password?
It shows you which password lists are being used against your site. It's only recorded for usernames that don't exist, so it never belongs to a real account. You can turn it off under Settings → Passwords.
Does it replace a lockout plugin like Limit Login Attempts?
It can run next to one. Those plugins lock an IP out for a while after failed logins. Phantom User Lockout records what was tried and blocks the IP permanently.
Can it block the whole site, not just the login page?
Yes: Settings → "A blocked IP cannot reach". Pages served from a caching plugin's disk cache never reach WordPress, so those can't be covered.
Where is the data kept?
In two database tables of the plugin's own. Attempt rows are removed after 180 days or 100,000 rows, whichever comes first, and you can change both limits. Blocked IPs are kept until you unblock them. Deactivating the plugin keeps everything. Deleting the plugin removes the tables and the settings.
更新日志:
- Renamed from Login Lockout to Phantom User Lockout.
- First public release.
- Records login attempts with usernames that don't exist, including the password tried, the IP's location and its hosting company.
- Permanent IP blocks, lifted only by Unblock.
- Safe IPs, with a one-click "Add my current IP address to the list".
- Optional blocking after wrong passwords for real accounts (default 3).
- Option to stop recording passwords.
- CSV export.