SentriLog - Limit Login Attempts, Security & Activity Log
| 开发者 | rayetun |
|---|---|
| 更新时间 | 2026年9月7日 13:19 |
| 捐献地址: | 去捐款 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
wp-login.php: bots hammer it with thousands of username and password guesses. SentriLog counts every failed attempt, locks out offenders automatically, records the whole story, and lets you move the login page somewhere bots can't find it.
Everything runs on your own site. SentriLog makes no external HTTP requests and sends no data to any third party — every lockout, log entry, and setting stays in your own WordPress database. No account, no API key, no tracking.
How SentriLog is built
- ⚡ Zero-config: protection and logging start the moment you activate — sensible defaults, nothing to set up
- 🔒 Privacy-first: no external calls, no data collection, no phone-home; your logs never leave your server
- 🪶 Lightweight: bot detection runs only on login/authentication events, so normal visitors are never slowed down
- 🧩 Works with any login form: hooks WordPress core auth (
authenticate,wp_login_failed,wp_login), so WooCommerce, membership, and custom login forms are all covered - 🌐 Multisite compatible: activate per-site or network-wide, each site with its own settings and log
- 🔢 Limit login attempts — lock an IP after a configurable number of failed tries within a rolling time window
- 📈 Progressive lockout escalation — repeat offenders are locked out for longer, automatically
- 👥 Per-IP + username tracking — attempts are counted per IP and username pair, so one attacker can't lock out everyone
- 🧮 Remaining-attempts hint — optionally tell users how many tries remain before a lockout
- 🧷 XML-RPC protection — detects and blocks
system.multicallbrute-force patterns - 🗂️ Lockout manager — view every active lockout with a live countdown, and clear one or all in a click
- 📝 Every event recorded — login successes, failures, logouts, lockouts, and password events, each with IP address, username, user-agent, and timestamp
- 🔍 Filter and search — narrow the log by event type, username, IP, or date range
- ⬇️ CSV export — download the activity log (respecting your current filters) for audits or spreadsheets
- 🧹 Retention & auto-cleanup — set how long logs are kept (90 days by default); old records are pruned automatically via WP-Cron
wp-login.php to a secret slug of your choice and block the default endpoint, so automated attacks never even find the login form. A built-in emergency recovery link means you can never be permanently locked out.
🪄 Magic Login
Generate temporary, single-use, passwordless login links for support staff or clients. The temporary user is created on demand and removed automatically the moment the link expires or is revoked — no lingering accounts.
⏲️ Idle Session Timeout
Automatically sign out inactive users after a period you choose, so an unattended browser doesn't become an open door.
🔐 Two-Factor Authentication
Add a second layer to any account — no external service, no account required.
- 📱 Authenticator app (TOTP) — works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any standard TOTP app
- 🔳 Local QR code — the setup QR is drawn in your browser, so the shared secret never leaves your site
- 🔑 Backup codes — single-use recovery codes for when you don't have your device
- 🔒 Encrypted at rest — the 2FA secret is encrypted in the database, so a stray database dump can't expose it
- 👤 Opt-in per user — each user turns it on from their own profile screen
- 🙈 Username enumeration protection — normalize login error messages, block
?author=Nand author-archive scans, and lock down the REST API users endpoint so attackers can't harvest valid usernames - 🌐 Configurable IP source — choose exactly how visitor IPs are detected (direct connection, Cloudflare, reverse proxy, or load balancer) so a spoofed header can't defeat your lockouts
- 🧷 XML-RPC multicall blocking — shut down a common amplification vector for password guessing
- ✉️ Email alerts — get notified after a configurable number of consecutive failures, and whenever a lockout is triggered
- 📊 At-a-glance dashboard — logins, failures, and lockouts over the last 24 hours and 7 days, with a 7-day trend chart (Chart.js, bundled locally — no external requests)
- 🌗 Light & dark mode — a clean, modern admin UI with a one-click theme toggle; light by default
- 🧰 Tabbed settings — Lockout, Security, Logging, and Notifications, each with sensible defaults
- Makes no external HTTP requests — nothing is ever sent off your server
- Stores data only in your own database to enforce lockouts and provide an audit trail
- Cleans up completely on uninstall — drops its tables, deletes its options, removes any temporary Magic Login users, and clears its scheduled events
- A
rayetun_lsn_anonymise_ipfilter is available if you want to anonymize stored IP addresses
rayetun_login_sentinel_event_logged( $event_type, $user_id, $username, $ip, $extra_data )— fires after every logged eventrayetun_login_sentinel_lockout_triggered( $ip, $username, $duration, $attempt_count )— fires when an IP is locked outrayetun_login_sentinel_should_lockout( $should_check, $ip, $username )— short-circuit the lockout check (e.g. for an allowlist)rayetun_lsn_anonymise_ip— filter stored IP addresses for anonymizationrayetun_login_sentinel_2fa_verified( $user_id )— fires after a user passes two-factor verification
安装:
- Upload the
sentrilogfolder to/wp-content/plugins/, or install directly through Plugins → Add New. - Activate the plugin through the Plugins screen in WordPress.
- Go to SentriLog → Dashboard to watch your login activity in real time.
屏幕截图:
常见问题:
❓ Will this plugin lock me out of my own site?
It can, if you enter the wrong credentials too many times. If it happens, you have three easy ways back in: use the Change Login URL emergency recovery link, temporarily deactivate the plugin by renaming its folder over FTP/SSH, or remove the lockout in your database with DELETE FROM wp_rayetun_lsn_lockouts WHERE ip_address = 'YOUR_IP';.
🌐 Does it make any external requests or send my data anywhere?
No. SentriLog makes zero external HTTP requests and sends no data to any third party. Every lockout, log entry, and setting is stored only in your own WordPress database. The dashboard chart uses Chart.js, which is bundled locally in the plugin (MIT licensed) — no CDN, no external host.
🔌 Does it work with WooCommerce, membership plugins, or custom login forms?
Yes. SentriLog hooks WordPress core authentication filters (authenticate, wp_login_failed, wp_login), which fire no matter which login form is used — WooCommerce, BuddyPress, membership plugins, and custom forms are all protected.
🕵️ Can I hide my login page?
Yes. The Change Login URL feature moves wp-login.php to a secret slug you choose and blocks the default endpoint, so bots can't find the form. An emergency recovery link makes sure you can always get back in.
🪄 What is Magic Login?
Magic Login creates a temporary, single-use, passwordless login link you can hand to support staff or a client. The temporary user is removed automatically when the link expires or you revoke it — no leftover accounts.
🔐 How do I turn on two-factor authentication?
Go to Users → Profile and scroll to the Two-Factor Authentication section. Scan the QR code with any authenticator app, enter the 6-digit code to confirm, and save your profile. You'll be shown a set of backup codes once — store them somewhere safe. From then on, you'll enter a code from your app each time you log in. To turn it off, tick "Disable two-factor authentication" on the same screen and save. (Trusted devices, email codes, and requiring 2FA for whole roles are available in the Pro add-on.)
🛡️ Does it protect XML-RPC?
Yes. SentriLog detects system.multicall brute-force patterns and blocks that request, closing a common password-guessing amplification vector.
📜 Is it GDPR-friendly?
SentriLog stores IP addresses in your own database to enforce lockouts and keep an audit trail — IP addresses can be personal data, so you should disclose this in your site's privacy policy. Nothing is ever transmitted to us or any third party, logs are auto-deleted after your chosen retention period, and a rayetun_lsn_anonymise_ip filter is available if you want to anonymize stored IPs.
📤 Can I export the activity log?
Yes. Export the activity log to CSV directly from the Activity Log screen, respecting whatever filters you have applied.
🌍 Does it work on WordPress Multisite?
Yes. When network-activated, SentriLog creates its tables for each sub-site, and each site keeps its own independent settings and log.
♻️ What happens when I uninstall?
Everything is cleaned up: all custom tables are dropped, plugin options are deleted, any temporary Magic Login users are removed, and scheduled events are cleared. Nothing is left behind.
💬 Get support
Post in the WordPress.org support forum. We aim to respond within 24 hours on business days.
更新日志:
- New: Two-Factor Authentication — app-based TOTP (Google Authenticator, Authy, and any standard app) with a locally generated QR code and single-use backup codes, enabled per user from the profile screen.
- The 2FA secret is encrypted at rest (libsodium); the QR is rendered in the browser, so nothing is sent to any third party.
- Initial release.
- Limit login attempts with configurable max attempts, rolling time window, and lockout duration.
- Progressive lockout escalation for repeat offenders, tracked per IP + username.
- Full authentication activity log (logins, failures, logouts, lockouts, password events) with filtering and CSV export.
- Change Login URL — hide wp-login.php behind a custom slug with an emergency recovery link.
- Magic Login — temporary, single-use, passwordless login links that clean themselves up.
- Username enumeration protection — login error normalization, author-scan blocking, and REST API users lockdown.
- Idle session timeout with a JavaScript heartbeat.
- Configurable client IP source (direct, Cloudflare, reverse proxy, load balancer) to prevent header spoofing.
- XML-RPC system.multicall brute-force protection.
- Email alerts on repeated failures and on lockout.
- Admin dashboard with stats, a 7-day trend chart (Chart.js, bundled locally), the activity log, and the lockout manager.
- Light and dark admin theme with a one-click toggle.
- Tabbed settings: Lockout, Security, Logging, Notifications.
- WP-Cron–powered log retention and expired-lockout cleanup.
- WordPress Multisite compatible.
- Makes no external requests and collects no data — everything stays in your database.
- Full internationalization support via the bundled
.potfile.