Takumi Private Gate turns a WordPress install into a fully private site: nothing is reachable without logging in first. It’s built for people running a diary, notes site, or internal tool on WordPress that should never be publicly visible or crawlable.

Unlike most “force login” or “password protect” plugins, Takumi Private Gate combines four protections in a single, dependency-free plugin:

Site-wide lockdown: every page, post, and feed redirects unauthenticated visitors to the standard WordPress login screen.
REST API blocking: unauthenticated requests to /wp-json/ receive a 401 Unauthorized response.
XML-RPC turned off: every XML-RPC method that requires authentication is refused, so /xmlrpc.php cannot be used to log in, post, or brute-force credentials.
Failed-login lockout: an IP address is locked out for a configurable amount of time after too many failed login attempts, and by default the plugin says nothing that would tell an attacker they’re locked out.

Developed and maintained by Yoshiro Moriyama, founder of Takumi Web Services, a WordPress development studio based in Toronto, Canada.

Features

Redirects every unauthenticated front-end request to wp-login.php.
Returns 401 Unauthorized for unauthenticated REST API requests.
Turns off XML-RPC by refusing every authenticated XML-RPC method (xmlrpc_enabled), which closes the login, publishing, and brute-force paths. WordPress still answers /xmlrpc.php for its own unauthenticated introspection methods such as system.listMethods; blocking the file outright is a job for the web server.
Locks out an IP address after a configurable number of failed login attempts (default: 5 attempts / 30 minutes).
Counts failed Application Password attempts (REST and XML-RPC) toward the same per-IP limit, and refuses Application Password authentication while an IP is locked out.
Lockout state is stored per IP address, not per username.
Lists every currently locked-out IP with a one-click unlock button.
Keeps a rolling log (most recent 1000 attempts) of login attempts with date, IP, username, and result.
Emails the site admin address whenever an IP gets locked out (can be turned off).
IP whitelist (single IPs or CIDR ranges) that bypasses the lockdown, the API blocking, and the lockout entirely.
Optional per-user TOTP two-factor authentication (compatible with Google Authenticator, Authy, 1Password, etc.) enrolled from each user’s own profile screen.
Network-activation aware: sets up per-site defaults and its login-log table on every site of a multisite network.
Single screen of its own in the admin sidebar.
Uninstalling the plugin removes its options, its login-log table, and any 2FA secrets.