Smarto Login Security brings the controls for how people sign in to your site into one place: where they sign in, how they prove who they are, and what happens to their sessions afterwards.

Every rule is enforced on the server when credentials are checked. A hidden URL or a missing button is never the only protection.

Login URL and redirects

Move the login page to your own address and hide wp-login.php and wp-admin from visitors.
See which IP addresses tried to sign in on your hidden address, so you know if it leaked.
Choose the default page after login and logout, and with WooCommerce a separate page after signing in on My Account. Redirects are limited to your own site.
Staff (anyone who can use the dashboard) sign in only on the custom login URL, on by default and can be switched off. Every other login form, such as WooCommerce My Account or other plugins’ login pages, answers “wrong username or password” even with the right password, and you get an email alert. A list shows where people really sign in, found automatically from the Login History.

Two-factor authentication

Authenticator apps (TOTP), set up with a QR code and confirmed before activation.
Email codes.
Single-use backup codes.
Require 2FA for chosen roles. Choose what happens to users who have not set up a method yet: remind them, send them email codes at every sign-in, or require setup before they can use the dashboard.
No session is created until the second factor is passed.

Brute-force and abuse protection

Failed-login limits per IP address and per account, shared by every login form, with lockouts that double each time they repeat. The error tells people how many attempts they have left, and a locked visitor sees the lockout as soon as they open the login page. IPv6 addresses are counted per network, so switching addresses does not reset the count.
Rate limits for password reset and registration.
CAPTCHA with your choice of Cloudflare Turnstile, Google reCAPTCHA (v3, v2 invisible or v2 checkbox) or hCaptcha (checkbox or invisible) on login, registration, lost-password and new-password forms, including WooCommerce. Theme, size, badge position and language options, an option to show it only after failed sign-ins, and a key test that runs a real check with your keys before you save them. Always verified on the server.
Username enumeration protection: one error message for wrong usernames and wrong passwords, the same response to password-reset requests for unknown accounts, blocked ?author=N lookups, and a hidden REST user list.
IP blocklist and allowlist with IPv4, IPv6 and CIDR ranges. Forwarded headers are trusted only from proxies you list.
XML-RPC and application passwords: block sign-ins over XML-RPC (pingbacks still work) or turn XML-RPC off completely, and allow application passwords for everyone, administrators only or nobody.

Sessions and accounts

Active Sessions screen: who is signed in, last activity, sign-in time, IP address and country, browser and sign-in method. Your own session is marked, and you can end all your other sessions in one click.
End one session or all of a user’s sessions. Ending a session revokes it in WordPress, so the cookie stops working immediately.
Suspend accounts temporarily or permanently, with an internal reason. Suspended users are signed out everywhere and refused by every login form, XML-RPC and application passwords.
Login History of sign-ins, failures and blocks with country, filters and configurable retention. The country is looked up in a database included with the plugin, so no IP address leaves your site.
Admin Activity: changes made to this plugin (settings, IP rules, suspensions, ended sessions, 2FA changes), with who made them and the affected user.
Choose how long each log is kept (30 days by default) or switch it off. Logs cannot be deleted by hand, so an intruder cannot cover their tracks.
Email alerts for lockouts, administrator logins from new IP addresses, suspensions, settings changes and provider failures, grouped so attacks don’t flood your inbox.

WooCommerce

The WooCommerce My Account login, registration, lost-password and new-password forms get the same protection. Checkout is never modified.
A Diagnostics page tests your login address and reports conflicts and what is and is not covered.

Smarto Login Security Pro

Everything above is free and works without an account. Smarto Login Security Pro is a separate plugin, sold on wpsmarto.com, that adds role-specific and exclusive login routes, redirects by role and user, SMS codes, passwordless sign-in, temporary access links, live online status, roles limited to trusted IP addresses, and role and IP rules for other plugins’ login forms.

What it does not do

It is not a firewall or malware scanner.
Hiding the login URL reduces automated attacks; it does not replace strong passwords and 2FA.
Application passwords are separate credentials and do not ask for 2FA (WordPress design). Suspensions and lockouts still apply to them, and you can limit them to administrators or turn them off.
Login forms that create sessions without using WordPress authentication are covered only partly. See the Diagnostics page.

External services

The plugin contacts external services only when you configure them. Nothing is sent to WP Smarto, and the plugin includes no tracking or analytics.

Cloudflare Turnstile (optional)

Used to tell people from bots on the forms you choose. When a visitor loads a protected form, their browser loads Cloudflare’s script from challenges.cloudflare.com, which collects device and browser data. When the form is submitted, your site sends the token and the visitor’s IP address to challenges.cloudflare.com to verify it.
Terms: https://www.cloudflare.com/website-terms/
Privacy: https://www.cloudflare.com/privacypolicy/

Google reCAPTCHA (optional)

Same purpose. When a visitor loads a protected form, their browser loads Google’s script from google.com (or recaptcha.net, if you choose that option), which collects device and browser data. When the form is submitted, your site sends the CAPTCHA token and the visitor’s IP address to Google to verify it.
Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy

hCaptcha (optional)

Same purpose and data flow, through js.hcaptcha.com and api.hcaptcha.com.
Terms: https://www.hcaptcha.com/terms
Privacy: https://www.hcaptcha.com/privacy

Privacy

The plugin stores security information to protect accounts: usernames tried, IP addresses and their approximate country (looked up in a database included with the plugin, never online), browser user agents (optional), times, sign-in methods and results, and session activity for the roles you choose to track. Logs are kept for 30 days by default and deleted automatically after the period you set; each log can also be switched off under Settings. A suggested privacy-policy text is added to Settings > Privacy, and the data works with WordPress’s personal data export and erasure tools.

Passwords, verification codes, sign-in tokens and secrets are never logged. Codes and tokens are stored only as keyed hashes, and authenticator secrets and provider keys are encrypted.

Development

The plugin’s JavaScript and CSS are shipped unminified. The IP to country data in data/ip-country.dat is IP Geolocation by DB-IP (https://db-ip.com), IP to Country Lite, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), converted to a compact lookup format. It is updated with plugin releases. The bundled QR code library is qrcode-generator 1.4.4 by Kazuhiko Arase (MIT license, https://github.com/kazuhikoarase/qrcode-generator), included unminified in assets/vendor/qrcode-generator/.