Smarto Login
Security.
Every sign-in control in one place. Hide your login page, require two-factor authentication and stop password guessing, all enforced on the server.
Give each role its own login address, let people sign in without a password, hand out temporary access, and see who is online. The Login History shows the exact page behind every attempt, so you know when someone has found your hidden login URL.
Password accepted
One more step for administrators.
LOGIN HISTORY
- Verification code sentCustom login URLnow
Clear controls
for every sign-in.
Where people sign in, how they prove who they are, and what happens to their sessions afterwards. All from one menu in wp-admin.
One overview of your sign-in protection, recent events and what still needs attention.
One plugin
for the whole login.
Replace a stack of single-purpose plugins with one that knows how every rule fits together, from the login address to the last active session.
Custom Login URLs
Move the login page to your own address and hide wp-login.php and wp-admin from visitors.
Role-based Routes
Give roles or users their own login address. Make it exclusive and limit it to specific IPs.
Two-factor Authentication
Authenticator apps, email codes, SMS via Twilio and backup codes. Require it for chosen roles.
Passwordless Sign-in
Magic links with a confirmation click so email scanners can't use them, or six-digit email codes.
Temporary Access
Time-limited, single-use or IP-limited links for developers and support. Revoke them any time.
Brute-force Limits
Failed-login limits per IP and per account with lockouts that double, plus CAPTCHA and rate limits.
Live Sessions
See who is online, idle or offline. End one session or all of them and the cookie stops working.
Account Suspension
Suspend accounts temporarily or permanently. Suspended users are signed out and refused everywhere.
AND ALSO
Different sites,
different front doors.
Turn on only what your site needs. Every feature is off or set to a safe default until you choose it, so a shop, a course site and an agency client each get the protection that fits.
Online stores
Customers and staff share one login.
CAPTCHA and lockouts on the My Account forms, 2FA and a private login address for staff. Checkout is never touched.
Membership and course sites
Hundreds of accounts, each a way in.
Protects your membership or course plugin's own login form, stops password guessing and suspends accounts you no longer trust.
Agencies and client sites
Developers and support need access, then should lose it.
Temporary links that expire, can be single-use or IP-limited, plus recovery switches and WP-CLI if anyone gets locked out.
Publishers and teams
Many editors, some with weak passwords.
Required 2FA per role, live sessions you can end, and an email when an administrator signs in from a new IP.
Business websites
Bots hammer wp-login.php all day.
Moves the login page, shows bots a 404, limits failed attempts and gives the same error for every wrong guess.
Enforced on the server.
Not hidden behind a URL.
Every rule runs when credentials are checked. A hidden login address or a missing button is never the only thing standing between an attacker and your site.
Right door, right person
The login route, its allowed roles and its IP rules are checked first. Exclusive routes refuse their users on every other form.
Bots filtered out
Lockouts, rate limits and CAPTCHA are verified on the server, shared by every login form and route.
Password and account status
One error message for wrong usernames and passwords. Suspended accounts are refused, including XML-RPC.
Second factor before any session
No session exists until 2FA is passed. Required roles without a method are reminded, sent email codes or made to set one up, as you choose.
Tracked and revocable
The session appears in Active Sessions and the Login History. End it and the cookie stops working immediately.
A separate door
for every role.
Hide the default login page, then decide who can sign in where. Each route can be limited to chosen roles, users and IP addresses.
Your own login address
Move the login page to a URL you choose. Visitors who open wp-login.php or wp-admin see your theme's 404 page, or a page you pick.
Routes per role or user
Give administrators, editors or individual users their own login address. Only the people you list can sign in there.
Exclusive routes
Mark a route exclusive and its users are refused on every other login form, even with the right password.
Redirects after login and logout
Send people to the right page by default, per role or per user, or back to the page they were trying to reach. Only pages on your own site are allowed.
The new login address is emailed to the site administrator whenever it changes. Custom login URLs and role routes need pretty permalinks.
A hidden login page
you can keep an eye on.
Hiding wp-login.php stops most bots. If someone still finds your new address, you will see who, from where and with which username, and you can change it before it matters.
Who knows your login URL
These IP addresses tried to sign in on your custom login URLs but have never signed in to this site.
| IP address | Usernames tried | Attempts | Login page | Actions |
|---|---|---|---|---|
198.51.100.712 minutes ago | admin, editor | 14 | /signin-k3v9qm/ | History · Block IP |
203.0.113.242 days ago | sarah | 3 | /team-login/ | History · Block IP |
The exact page, every time
Each event records the login page that was used, such as your custom address, a role route or the lost-password form, and the page a visitor came from.
Hidden pages are watched
Visits to the hidden wp-login.php and wp-admin are recorded once per IP per hour, with the username when someone tries to sign in there.
Unknown visitors are flagged
A failed sign-in on your custom address from an IP that has never signed in is shown on the Overview and can send you an email.
Act in one click
Block the IP, open its full history, or change your login address straight from the same card.
A password is not
enough on its own.
Require a second step for the roles you choose. Each user sets up their own methods on their profile page, and no session exists until the second factor is passed.
Authenticator apps
TOTP apps such as Google Authenticator or 1Password, set up with a QR code and confirmed before they turn on.
Email codes
A one-time code sent to the user's email address at sign-in.
Text messages
SMS codes sent through your own Twilio account.
Backup codes
Single-use codes for the day a phone is lost or out of battery.
WHEN SOMEONE IN A REQUIRED ROLE HAS NOT SET UP 2FA YET
Remind
Users sign in normally and see a notice on their dashboard until they set up 2FA.
Email codes
Users get a code by email at every sign-in until they add their own method. Protected from the first login.
Require setup
Users sign in once, then must add an authenticator app or text messages before they can use the dashboard. Email codes alone do not count.
Sign in with
just an email.
Fewer passwords to forget, reuse or leak. Members and customers sign in from their inbox, with rate limits on every request.
YOUR SIGN-IN LINK
Click the button below to finish signing in.
Confirm and sign inThe link works once and expires after the time you set.
Magic links by email
One link signs the user in. A confirmation click on the landing page means email scanners that open links cannot use them.
Six-digit sign-in codes
Prefer a code? Users type a short code from their inbox instead of a password.
Nothing to learn for attackers
The response is the same whether or not an account exists, so the form cannot be used to find usernames.
2FA still counts
Accounts that need two-factor must also pass a factor other than email. Choose which roles may use passwordless sign-in.
Let a developer in.
Without your password.
Give a developer, designer or support agent a time-limited access link. The link is shown once, can be emailed to them, and every use is recorded in the Login History.
ACCESS LASTS
Temporary accounts are never asked to set up an authenticator app. If your site sends email codes to users without one, they still get them.
Expires on its own
Pick a duration or an end date. The link stops working when time is up.
Single-use links
Limit how many times a link can be used, down to once.
IP-limited
Allow the link only from the IP addresses you list.
Revoke any time
Revoking a link also ends every session it created.
Existing or temporary account
Link to an existing user, or have a temporary account created for the job.
Cleaned up after
When access ends, the temporary account is suspended, or deleted with its content reassigned to you.
Bots give up.
Real users don't notice.
Password guessing, form flooding and username hunting are stopped on the server, the same way on every login form.
Failed-login limits
Limits per IP address and per account, shared by every login form and route. Lockouts double each time they repeat, up to a maximum you set.
Rate limits
Cap password reset requests, registrations and magic link or email code requests, so forms cannot be used to flood inboxes.
CAPTCHA
Google reCAPTCHA v2 checkbox, reCAPTCHA v3 with a minimum score, or hCaptcha. Always verified on the server, with a safe choice for when the provider is down.
Username protection
One error for wrong usernames and wrong passwords, the same reply to password resets for unknown accounts, and no ?author=N lookups.
CAPTCHA ON THE FORMS YOU CHOOSE
AND FEWER PLACES TO FIND USERNAMES
- Hide the REST API user list
- Remove author names from oEmbed
- Remove the users sitemap
- Hide author archives by role
Decide where
sign-ins come from.
Block the networks attacks come from, and keep the most powerful accounts reachable only from places you trust.
Blocklist and allowlist
Add single addresses or whole ranges, in IPv4, IPv6 or CIDR notation.
Admins only from trusted IPs
Choose roles that may sign in only from allowlisted addresses, and sign them out if their IP changes.
Trusted networks skip the checks
Allowlisted IPs can skip lockouts, rate limits and CAPTCHA, so your team is never slowed down.
Works behind Cloudflare and proxies
Pick the header your proxy sets, such as CF-Connecting-IP, and list its IP ranges. Headers from anywhere else are ignored, so visitors cannot fake their IP.
See who is signed in.
Sign them out in a click.
Track sessions for the roles you choose, including activity on the public site. Ended sessions are kept for as many days as you set.
| User | Status | Sign-in method | Location | |
|---|---|---|---|---|
| sarahAdministrator | online | Password + 2FA | Berlin, DE | End session |
| dev-tempTemporary | idle | Access link | Lisbon, PT | End session |
| markEditor | offline | Magic link | Austin, US | End session |
Who is online right now
Online, idle or offline, with last activity, sign-in time, IP address, browser, sign-in method and optional approximate location.
End a session instantly
End one session or all of a user's sessions. The session is revoked in WordPress, so the cookie stops working at once.
Suspend an account
Suspend temporarily or permanently, with an internal reason. Suspended users are signed out everywhere and refused by every login form, XML-RPC and application passwords.
Status on the Users screen
See suspension, 2FA status, last login and sessions for each user in the regular WordPress Users list.
Location is optional and approximate. Use the Cloudflare country header, which sends nothing anywhere, or an ipinfo.io lookup.
Know what happened.
Hear about what matters.
An Overview page shows your protection status and configuration warnings at a glance, plus who tried your hidden login URL, the most targeted usernames and the top failing IPs, with one-click blocking. The Login History records the exact login page used for every event, with filters and the retention period you choose.
Overview at a glance
Each number links straight to the page where you can act on it.
Email alerts you choose
Send to one or more addresses. Similar emails are grouped, so an attack does not flood your inbox.
- Lockouts after repeated failed logins
- Every login by a privileged user
- Privileged login from a new IP address
- Someone unknown used your custom login URL
- Suspicious activity, such as blocked sessions
- Account suspended or restored
- Session ended by an administrator
- Security settings changed
- Temporary access created, revoked or expired
- CAPTCHA, email or SMS provider failures
Every login form.
Not just wp-login.php.
Stores, membership sites and course platforms often sign people in from their own pages. The same rules follow them there.
WooCommerce
The My Account login, registration and lost-password forms get CAPTCHA, lockouts, role rules and 2FA. Customers land on My Account, and checkout is never modified.
Other login forms
Label another plugin's login page or AJAX pop-up login, and your role and IP rules apply to it too.
Session guard
Blocks sessions that other code creates outside the protected login flow, so they cannot skip 2FA or exclusive routes.
Diagnostics
Tests your login addresses, checks that wp-login.php is hidden, reports conflicts, and shows what is and is not covered.
WHAT DIAGNOSTICS CHECKS
RECOGNISES POPULAR PLUGINS
Diagnostics also warns when another plugin, such as WPS Hide Login, Wordfence or Limit Login Attempts Reloaded, does the same job, so you never run two of the same feature.
Strict for attackers.
Forgiving for you.
Forgot your login URL or blocked your own IP? Add one line to wp-config.php, sign in, fix the setting and remove it. Or use WP-CLI.
define( 'WPSMARTO_LS_DISABLE_CUSTOM_LOGIN', true ); // restores wp-login.phpdefine( 'WPSMARTO_LS_DISABLE_ROUTE_RULES', true ); // turns off role routesdefine( 'WPSMARTO_LS_DISABLE_IP_RULES', true ); // turns off IP rulesdefine( 'WPSMARTO_LS_DISABLE_CAPTCHA', true ); // turns off CAPTCHAdefine( 'WPSMARTO_LS_DISABLE_2FA', true ); // if email or SMS is downdefine( 'WPSMARTO_LS_DISABLE_LOCKOUTS', true ); // turns off lockoutsdefine( 'WPSMARTO_LS_SAFE_MODE', true ); // all of the above# or from the command line$ wp smarto-ls login-url reset$ wp smarto-ls ip clear$ wp smarto-ls lockouts clear$ wp smarto-ls 2fa reset <user>
Nothing switches on by itself
Activation enables no restriction, so nobody gets locked out on install.
The new address is emailed
Whenever the custom login URL changes, the site administrator receives it by email.
Passwords still required
Recovery switches only relax extra restrictions. A normal WordPress password is always needed.
Private by default.
Clear about its limits.
Your data stays yours
- ✓No tracking, analytics or calls to WP Smarto
- ✓External services contacted only when you configure them
- ✓Passwords, codes, tokens and secrets are never logged
- ✓Codes and tokens stored only as keyed hashes
- ✓Authenticator secrets and provider keys encrypted
- ✓Old records deleted after your retention period
- ✓Works with WordPress personal data export and erasure
What it does not do
- iIt is not a firewall or malware scanner.
- iHiding the login URL reduces automated attacks. It does not replace strong passwords and 2FA.
- iIP-based location is approximate and can be wrong.
- iApplication passwords do not ask for 2FA (WordPress design). Suspensions and lockouts still apply.
- iLogin forms that skip WordPress authentication are covered only partly. Diagnostics shows where.
Simple for owners.
Open for developers.
Managing many sites? Send security events to your own tools, add rules to login routes, and manage sessions, IPs and accounts from WP-CLI.
add_action( 'wpsmarto_ls_event', ... ); // send every security event to Slack or your logadd_filter( 'wpsmarto_ls_access_policy', ... ); // add your own rules to login routesadd_filter( 'wpsmarto_ls_allow_unverified_session', ... ); // trust your own SSOadd_filter( 'wpsmarto_ls_default_login_allowed_actions', ... ); // keep a wp-login.php action openadd_filter( 'wpsmarto_ls_captcha_hostnames', ... ); // accept CAPTCHA from more domains$ wp smarto-ls status # what is on, in one screen$ wp smarto-ls sessions destroy <user> # sign someone out everywhere$ wp smarto-ls suspend <user> # lock an account from the server$ wp smarto-ls ip block 198.51.100.7 # block an address
Staging and agencies
Login URLs, 2FA, CAPTCHA, IP rules and lockouts can each be switched off in wp-config.php, so a copied site never locks you out.
Plays by the rules
GPL licensed, WordPress coding standards, nonces and capability checks on every action, every output escaped.
Your data stays put
Events and sessions live in the plugin's own tables. Nothing is sent to us.
Simple pricing.
Start free, scale anytime.
Choose the plan that fits your needs. Upgrade, downgrade, or cancel anytime. Prices are managed by the WP Smarto team.
Launching soon. These are the launch prices. Get notified and be the first to know when Pro is available.
- 1
Choose a plan
Pick the number of sites you need and complete checkout.
- 2
Download and install Pro
Download Smarto Login Security Pro from your WP Smarto account dashboard and install it next to the free plugin.
- 3
Activate with one click
In WordPress, open the Pro License page of Smarto Login Security and click Activate license. Log in to wpsmarto.com and approve the site.
Good questions
deserve clear answers.
A WordPress plugin that brings every sign-in control into one place: custom and role-based login URLs, two-factor authentication, passwordless and temporary access, brute-force limits, CAPTCHA, IP rules, live session monitoring and account suspension.
Lock the front door
of your site.
Smarto Login Security is on its way to the WordPress.org directory. Leave your name and email and we'll notify you the moment it goes live.