Web-Art Login Shield with reCAPTCHA

Yes. To use reCAPTCHA protection you must configure a reCAPTCHA v2 Site Key and Secret Key in the plugin settings.

Elementor Login and Elementor Forms reCAPTCHA can be enabled only after reCAPTCHA v2 is configured and successfully verified in the plugin settings.

Yes. IPs added to the reCAPTCHA allowlist bypass reCAPTCHA checks on wp-login.php, Elementor Login and Elementor Forms. This bypass applies only to reCAPTCHA - Login Protect rate limits and lockouts may still apply.

If reCAPTCHA protection is enabled for the given login or form and verification cannot be completed, the request is rejected to reduce the risk of automated bypass. Administrators can disable the feature in plugin settings or deactivate the plugin via hosting or FTP.

No. Login protection modules are disabled by default and must be explicitly enabled by an administrator.

No. The XML-RPC endpoint is not disabled. The plugin can optionally disable a small set of high-risk XML-RPC methods (pingback and system.multicall) when Login Protect is enabled and "Protect XML-RPC logins" is enabled. Login Protect can also optionally apply rate limiting/lockouts to XML-RPC authentication attempts under the same conditions.

For Elementor Login widgets and Elementor Forms, the plugin avoids injecting a second reCAPTCHA widget if it detects an existing widget or an existing g-recaptcha-response field on the form. If a g-recaptcha-response token is submitted, the plugin will use it for server-side verification. To avoid conflicts (duplicate widgets, mixed keys, different versions), it is recommended to keep only one reCAPTCHA integration active for a given login/form flow (including wp-login.php).

Login Protect applies rate limiting and temporary lockouts mainly to authentication attempts (wp-login.php, and optionally REST/XML-RPC logins). IP Blocking is a separate site-wide deny rule that blocks selected IPs from accessing the entire site (HTTP 403), regardless of login attempts.

When Advanced is enabled, wp-login.php and wp-admin are protected for non-authenticated visitors. The login screen is served only under the configured custom login URL slug. Both slug fields are required when Advanced is enabled, and saving is blocked if any field is empty. The default recommended redirect slug is "404" (redirects to /404/ so your theme can display its 404 template).

No. The Advanced login URL uses a single configured slug value. If you run a multilingual site, choose a neutral slug that you want to use across languages.

You can temporarily disable Advanced login URL protection via wp-config.php: define('LGRE_DISABLE_ADVANCED_LOGIN', true); Important: add the constant in wp-config.php before WordPress loads plugins. A safe place is between "Add any custom values..." and "That's all, stop editing!". After you regain access, remove the constant to restore Advanced login URL protection.

You can temporarily disable site-wide IP Blocking via wp-config.php: define('LGRE_DISABLE_IP_BLOCKING', true); Important: add the constant in wp-config.php before WordPress loads plugins. A safe place is between "Add any custom values..." and "That's all, stop editing!". After you regain access and remove your IP from the blocklist, remove the constant to restore IP Blocking.