Most WordPress security plugins protect sites by modelling attackers — maintaining lists of known bad IPs, known attack signatures, and known malicious patterns. Janric Shield takes the opposite approach.

Janric Shield models your legitimate users, not the attackers.

During a short learning phase it builds a behavioural profile of how your admins actually log in — when, where, from which networks, and how they interact with the login form. Once that profile is established, anything that deviates significantly from it is flagged as suspicious. A brand new attack tool, a previously unseen technique, a credential stuffing campaign — it doesn’t matter whether it appears on any blocklist. If it doesn’t look like you, it scores high.

How It Works

Learning Phase (Days 1–14)

The plugin silently observes every login attempt and builds a per-site, per-user baseline covering:

Login hour and day-of-week distribution
Countries and ISPs (ASNs) that have successfully authenticated
Form fill duration — your personal mean and variance
Keystroke timing rhythm — your natural typing coefficient of variation
Browser and device patterns
Which usernames actually exist on this site

No data leaves your server. Everything is stored locally in your WordPress database using Welford’s online algorithm — a compact statistical method that maintains running mean and variance without storing individual data points.

Advisory Phase (Days 7–14)

Once enough legitimate logins have been recorded, the plugin begins scoring attempts and showing you what would have been blocked — without actually blocking anything yet. This lets you verify the model is accurate before enabling enforcement.

Active Phase (Day 14+)

With blocking enabled, attempts are scored in real time against your learned baseline. Suspicious attempts are challenged with a math-based security question and a tarpitting delay. High-confidence attacks are blocked outright.

Scoring System

Every login attempt receives a suspicion score from 0 to 100:

0 — Clean, matches your normal profile
20–39 — Low anomaly, monitored
40–59 — Medium anomaly, monitored
50–79 — Suspicious, challenged (math question + delay)
80–100 — High confidence attack, blocked

What It Detects

Immediate (from day one, no learning required)

Honeypot field filled — hidden field invisible to real browsers
Canary username targeted — attempts on usernames like admin or root that don’t exist on your site
Known scripting tool user-agents — python-requests, curl, wget, sqlmap, nikto and others
Direct POST attacks — bots that bypass the login form entirely and POST credentials directly
XML-RPC brute force — including system.multicall batch attacks
Impossibly fast form submission — sub-500ms fills

After baseline established (7–14 days)

Login from a country never seen on this site
Login from a new ISP or network
Login attempt on a username that has never successfully authenticated here
Login at an unusual hour for this site
High velocity attempts from a single IP

After per-user profile established (20+ logins per user)

Form fill time significantly outside your personal normal
Keystroke rhythm significantly different from your established typing pattern

Site Hardening

Beyond login protection, Janric Shield also includes:

REST API username decoy — unauthenticated requests to /wp-json/wp/v2/users receive convincing fake usernames instead of your real ones. The probe is logged and scored.
XML-RPC control — monitor all XML-RPC calls (default) or disable the endpoint entirely
WordPress version hiding — removes the version number from page source, RSS feeds, asset URLs, HTTP headers, and the REST API index

Privacy

Janric Shield operates entirely on your own server. No data is transmitted to any external service except for optional IP geolocation lookups (country and network type) which use the public ip-api.com service. IP addresses are stored as SHA-256 hashes in the attempt log. No personally identifiable information is shared with Janric or any third party.

For Developers

The plugin is structured around five core classes:

JanricShield_Baseline — Welford online statistics engine, per-site and per-user profiles
JanricShield_Scorer — Scores attempts against the learned baseline
JanricShield_Capture — Hooks into WordPress authentication pipeline, captures behavioural signals
JanricShield_Enforcer — Acts on scores based on current mode and thresholds
JanricShield_DB — Database schema, migrations, and settings