內容簡介
DoLogin Security 外掛提供智能的暴力破解攻擊防護，能有效限制登入嘗試次數，並支援雙因素驗證及無密碼登入，提升 WordPress 網站的安全性。
【主要功能】
• 智能暴力破解攻擊防護
• 支援雙因素驗證登入
• 無密碼登入連結
• 地理位置限制登入嘗試
• 支援白名單和黑名單
• WooCommerce 登入支援
外掛標籤
開發者團隊
📦 歷史版本下載
原文外掛簡介
In one click, your WordPress login page will be pretected with the smart brute force attack protection! Any login attempts more than 6 in 10 minutes (default value) will be limited.
Limit the number of login attempts through both the login and the auth cookies.
Two-factor Authentication login.
KeyLockr SSO scan login with encrypted appdata hash verification and session-bound encryption.
Cloudflare Turnstile (better than Google reCAPTCHA).
GeoLocation (Continent/Country/City) or IP range to limit login attempts.
Passwordless login link.
Support Whitelist and Blacklist.
GDPR compliant. With this feature turned on, all logged IPs get obfuscated (md5-hashed).
WooCommerce Login supported.
XMLRPC gateway protection.
🛡️ Security, explained simply
🔑 A stolen database should not become a bag of ready-to-use login secrets.
DoLogin separates stored data from the WordPress authentication salts. If an attacker copies only the database—but does not have the salts from the site configuration—the protected values cannot be used as login links, TOTP seeds, or signing keys.
🔗 Passwordless and child-site tokens: compare without storing the secret
Secret in the generated link ➜ `salt-keyed HMAC` ➜ `database stores only the verifier`
The raw token is shown when it is created and is never saved in the token table.
Login recomputes the HMAC and compares it in constant time.
A copied database verifier cannot be pasted into a URL as a working login token.
One-time tokens are consumed with an atomic database update, so simultaneous replay attempts cannot both win.
🔐 TOTP and signing keys: encrypted when the server must recover them
TOTP seed or private key ➜ `authenticated encryption + site salt` ➜ `ciphertext in the database`
TOTP verification and digital signatures need the original secret at runtime, so these values cannot use a one-way hash. DoLogin encrypts them instead and rejects modified ciphertext. Existing TOTP seeds and Site Easy Login private keys are migrated automatically.
🏠 Site Easy Login: one signed message, one destination, one use
User + trusted public key + destination + issue time + random token ID ➜ `one Ed25519 signature`
The child site verifies the complete signed message with the public key already saved for that connection. Changing the user or destination breaks the signature, and an atomic consume step blocks replay.
📱 KeyLockr SSO: stable signing and encryption identity
Scan QR ➜ `approve on phone` ➜ `verify Safe + AppData binding` ➜ `WordPress login cookie`
Fixed per-site signing and encryption keypairs let KeyLockr reuse the same backend-owned connection identity.
Existing signing-only key storage is upgraded atomically with one persistent encryption keypair.
Incoming frames are signed, encrypted, timestamp-checked, replay-checked, rate-limited, and accepted only in the expected protocol phase.
Bind and Repair write the WordPress account hash to encrypted KeyLockr AppData, then read it back before completing.
Login requires exactly one WordPress user with the matching Safe ID and binding hash.
After a QR scan, the phone-unlock and approval prompt is highlighted in green so the next action is clear.
🚦 Force KeyLockr SSO that fails closed
Enable force mode after a verified admin binding ➜ `keep QR-only policy active` ➜ `never reopen older interactive login methods automatically`
DoLogin checks the current administrator binding before force mode can be enabled. After that policy is saved, a missing binding, changed App Tag, broken site identity, or unavailable KeyLockr service does not restore password, passwordless-link, connected-site, or password-reset login paths. The WordPress lost-password link and core password-reset screens are removed while force mode is active; unlinking and site-key reset are also blocked. Existing authenticated sessions can disable force mode from settings; if no session remains, rename the plugin folder through FTP or the hosting file manager before repairing the connection. WordPress Application Passwords remain available for API clients.
API
Call the function $link = function_exists( 'dologin_gen_link' ) ? dologin_gen_link( 'your plugin name or tag' ) : ''; to generate one passwordless login link for the current user.
Call the function $link = function_exists( 'dologin_gen_link' ) ? dologin_gen_link( 'note/tip for this generation', $user_id ) : ''; to generate a passwordless login link for the user which ID is $user_id.
The generated one-time used link will be expired after 7 days.
Define const SILENCE_INSTALL to avoid redirecting to setting page after installtion.
KeyLockr SSO Recovery
Forced KeyLockr SSO blocks password, passwordless-link, and connected-site interactive logins. Existing authenticated cookies and WordPress Application Passwords remain available.
DoLogin never restores another interactive login method because KeyLockr is unavailable or the saved binding becomes invalid. Use an existing authenticated administrator session to disable force mode. If no such session remains, rename the plugin folder through FTP or the hosting file manager, then repair the connection before enabling force mode again.
CLI
List all passwordless links: wp dologin list
Generate a passwordless link for one username (for the login name root): wp dologin gen root
Delete a passwordless link w/ the ID in list (for the record w/ ID 5): wp dologin del 5
How GeoLocation works
When visitors hit the login page, this plugin will lookup the Geolocation info from API, compare the Geolocation setting (if has) with the whitelist/blacklist to decide if allow login attempts.
Privacy
The online IP lookup service is provided by https://www.doapi.us. The provider’s privacy policy is https://www.doapi.us/privacy.
Based on the original code from Limit Login Attemps plugin and Limit Login Attemps Reloaded plugin.
