XeroWP
SentriLog – Limit Login Attempts, Security & Activity Log
SentriLog – Limit Login Attempts, Security & Activity Log

SentriLog – Limit Login Attempts, Security & Activity Log

0/5 (0 ratings) — active installs Updated Sep 18, 2026
Activity LogBrute Forcehide login urllimit login attemptslogin security
Download v1.2.0 Plugin Website
Dashboard — at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart.

Dashboard — at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart.

🛡️ SentriLog is the free way to stop brute-force attacks on your WordPress login and see exactly what is happening at your front door. Install, activate, and you’re protected — smart per-IP lockouts, a full authentication activity log, login hardening, and instant email alerts, all with zero configuration required.

Most attacks on WordPress start at wp-login.php: bots hammer it with thousands of username and password guesses. SentriLog counts every failed attempt, locks out offenders automatically, records the whole story, and lets you move the login page somewhere bots can’t find it.

Everything runs on your own site by default. SentriLog makes no external HTTP requests out of the box — every lockout, log entry, and setting stays in your own WordPress database. No account, no tracking. The one optional exception is the CAPTCHA integration (Google reCAPTCHA or Cloudflare Turnstile), which stays off until you add your own keys (fully disclosed under External Services below).

How SentriLog is built

  • ⚡ Zero-config: protection and logging start the moment you activate — sensible defaults, nothing to set up
  • 🔒 Privacy-first: no data collection and no phone-home; no external calls at all unless you switch on the optional CAPTCHA (reCAPTCHA or Turnstile)
  • 🪶 Lightweight: bot detection runs only on login/authentication events, so normal visitors are never slowed down
  • 🧩 Works with any login form: hooks WordPress core auth (authenticate, wp_login_failed, wp_login), so WooCommerce, membership, and custom login forms are all covered
  • 🌐 Multisite compatible: activate per-site or network-wide, each site with its own settings and log

⚡ Smart Brute-Force Protection

Lock out attackers automatically, without locking out your real users.

  • 🔢 Limit login attempts — lock an IP after a configurable number of failed tries within a rolling time window
  • 📈 Progressive lockout escalation — repeat offenders are locked out for longer, automatically
  • 👥 Per-IP + username tracking — attempts are counted per IP and username pair, so one attacker can’t lock out everyone
  • 🧮 Remaining-attempts hint — optionally tell users how many tries remain before a lockout
  • 🧷 XML-RPC protection — detects and blocks system.multicall brute-force patterns
  • 🗂️ Lockout manager — view every active lockout with a live countdown, and clear one or all in a click

📋 Full Activity Log & Audit Trail

Know who tried to get in, from where, and when.

  • 📝 Every event recorded — login successes, failures, logouts, lockouts, and password events, each with IP address, username, user-agent, and timestamp
  • 🔍 Filter and search — narrow the log by event type, username, IP, or date range
  • ⬇️ CSV export — download the activity log (respecting your current filters) for audits or spreadsheets
  • 🧹 Retention & auto-cleanup — set how long logs are kept (90 days by default); old records are pruned automatically via WP-Cron

🔑 Access Control

🚪 Change Login URL
Move wp-login.php to a secret slug of your choice and block the default endpoint, so automated attacks never even find the login form. A built-in emergency recovery link means you can never be permanently locked out.

🪄 Magic Login
Generate temporary, single-use, passwordless login links for support staff or clients. The temporary user is created on demand and removed automatically the moment the link expires or is revoked — no lingering accounts.

⏲️ Idle Session Timeout
Automatically sign out inactive users after a period you choose, so an unattended browser doesn’t become an open door.

🔐 Two-Factor Authentication

Add a second layer to any account — no external service, no account required.

  • 📱 Authenticator app (TOTP) — works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any standard TOTP app
  • 🔳 Local QR code — the setup QR is drawn in your browser, so the shared secret never leaves your site
  • 🔑 Backup codes — single-use recovery codes for when you don’t have your device
  • 🔒 Encrypted at rest — the 2FA secret is encrypted in the database, so a stray database dump can’t expose it
  • 👤 Opt-in per user — each user turns it on from their own profile screen

🧱 Login Hardening

  • 🙈 Username enumeration protection — normalize login error messages, block ?author=N and author-archive scans, and lock down the REST API users endpoint so attackers can’t harvest valid usernames
  • 🌐 Configurable IP source — choose exactly how visitor IPs are detected (direct connection, Cloudflare, reverse proxy, or load balancer) so a spoofed header can’t defeat your lockouts
  • 🧷 XML-RPC multicall blocking — shut down a common amplification vector for password guessing

🤖 CAPTCHA (optional)

Add a CAPTCHA to your login, lost-password, and registration forms to stop bots before they ever reach your credentials. Off by default — bring your own free keys to switch it on.

  • 🛡️ Choose your provider — Google reCAPTCHA or Cloudflare Turnstile, a privacy-first challenge that does not track users
  • 🧩 reCAPTCHA v3 (invisible) or v2 (checkbox) — v3 scores requests silently; v2 shows the classic “I’m not a robot” checkbox
  • 🎯 Adjustable score threshold for reCAPTCHA v3 — tune how strict the bot filter is
  • 🗂️ Per-form control — protect the login, lost-password, and/or registration forms independently
  • 🔐 Verified server-side with your secret key; fails open during a provider outage so you’re never locked out

CAPTCHA is the only part of SentriLog that contacts an external service — see the External Services section for the full data disclosure.

🔔 Alerts & Dashboard

  • ✉️ Email alerts — get notified after a configurable number of consecutive failures, and whenever a lockout is triggered
  • 📊 At-a-glance dashboard — logins, failures, and lockouts over the last 24 hours and 7 days, with a 7-day trend chart (Chart.js, bundled locally — no external requests)
  • 🌗 Light & dark mode — a clean, modern admin UI with a one-click theme toggle; light by default
  • 🧰 Tabbed settings — Lockout, Security, Logging, and Notifications, each with sensible defaults

🔒 Privacy First

SentriLog is built to protect your users’ privacy as well as your site:

  • Makes no external HTTP requests by default — the only feature that contacts an outside service is the optional CAPTCHA (Google reCAPTCHA or Cloudflare Turnstile), which stays off until you enable it (see External Services)
  • Stores data only in your own database to enforce lockouts and provide an audit trail
  • Cleans up completely on uninstall — drops its tables, deletes its options, removes any temporary Magic Login users, and clears its scheduled events
  • A rayetun_lsn_anonymise_ip filter is available if you want to anonymize stored IP addresses

👩‍💻 For Developers

SentriLog is built on WordPress standards and exposes hooks so you can extend it:

  • rayetun_login_sentinel_event_logged( $event_type, $user_id, $username, $ip, $extra_data ) — fires after every logged event
  • rayetun_login_sentinel_lockout_triggered( $ip, $username, $duration, $attempt_count ) — fires when an IP is locked out
  • rayetun_login_sentinel_should_lockout( $should_check, $ip, $username ) — short-circuit the lockout check (e.g. for an allowlist)
  • rayetun_lsn_anonymise_ip — filter stored IP addresses for anonymization
  • rayetun_login_sentinel_2fa_verified( $user_id ) — fires after a user passes two-factor verification

Upgrade to SentriLog Pro

SentriLog is fully functional on its own — Pro is an optional upgrade for teams and agencies that want more. It adds, among other things:

  • Advanced two-factor authentication — passkeys / WebAuthn (Face ID, Touch ID, security keys), email OTP, trusted-device bypass, and per-role enforcement
  • IP allowlist & blocklist with CIDR ranges, plus country blocking with separate block and allow lists
  • Breached-password protection (Have I Been Pwned) and login anomaly detection (impossible travel + new device)
  • File integrity monitoring, threat-intelligence IP reputation, and business-hours admin access
  • Slack, Discord & webhook alert routing, self-service lockout recovery, and a weekly security digest
  • Agency tools — a multisite network dashboard, settings export/import & sync, and white-labeled client PDF reports

Every plan includes a 14-day free trial. Open SentriLog Go Pro in your dashboard for the full list and pricing.

External Services

SentriLog is self-contained and, by default, makes no external requests. Its optional CAPTCHA feature can use one of two third-party providers, both disabled by default and used only if you choose to turn one on. You pick the provider and supply your own keys.

Google reCAPTCHA

If you select Google reCAPTCHA under SentriLog Settings CAPTCHA and enter your own keys, SentriLog protects the login, lost-password, and/or registration forms you select with Google reCAPTCHA, a bot-detection service provided by Google.

  • When it runs: only on the forms you choose to protect, and only while reCAPTCHA is enabled with valid keys. Visitors’ browsers load the reCAPTCHA script from Google, and when a protected form is submitted the reCAPTCHA token and the visitor’s IP address are sent to Google to confirm the request is human.
  • Data sent: the reCAPTCHA response token and the visitor’s IP address. No other personal data is transmitted, and nothing is sent when reCAPTCHA is disabled.
  • Endpoints: the script is loaded from https://www.google.com/recaptcha/api.js and tokens are verified at https://www.google.com/recaptcha/api/siteverify.
  • Terms: use of Google reCAPTCHA is subject to Google’s Terms of Service and Privacy Policy.

Cloudflare Turnstile

If you select Cloudflare Turnstile under SentriLog Settings CAPTCHA and enter your own keys, SentriLog protects the forms you select with Cloudflare Turnstile, a privacy-first bot-detection service provided by Cloudflare that does not track users or serve interactive image challenges.

  • When it runs: only on the forms you choose to protect, and only while Turnstile is enabled with valid keys. Visitors’ browsers load the Turnstile script from Cloudflare, and when a protected form is submitted the Turnstile token and the visitor’s IP address are sent to Cloudflare to confirm the request is human.
  • Data sent: the Turnstile response token and the visitor’s IP address. No other personal data is transmitted, and nothing is sent when Turnstile is disabled.
  • Endpoints: the script is loaded from https://challenges.cloudflare.com/turnstile/v0/api.js and tokens are verified at https://challenges.cloudflare.com/turnstile/v0/siteverify.
  • Terms: use of Cloudflare Turnstile is subject to Cloudflare’s Website Terms of Use and Privacy Policy.

If you never enable CAPTCHA, SentriLog makes no external requests at all.

Credits

SentriLog is built and maintained by Md Rayhan Uddin.

This plugin bundles the following open-source library, served locally from the plugin — no external requests are made to load it:

  • Chart.js v4.5.1 — used to render the dashboard trend chart. Copyright (c) Chart.js Contributors, MIT License. Project: https://www.chartjs.org

Thank you to the WordPress community and to everyone who reports issues and suggests features on the support forum.