LAUNCH30 at checkout, until 30 November. See the pluginsSee plugins
Brute-force protection and modern two-factor authentication — authenticator apps, backup codes, and passkeys — for WordPress.
Features
Brute-force protection and modern two-factor authentication (authenticator apps, backup codes, and passkeys) for WordPress. Feeds Dragon Activity Log when installed.
Sign in with your device instead of a code; the modern, phishing-resistant standard
Works with Google Authenticator, 1Password, Authy, and any RFC 6238 app
Downloadable recovery codes for when you lose your device
Escalating lockouts after repeated failed logins, with IP allow/deny lists
No auth cookie is issued until the second factor passes; secrets encrypted at rest, backup codes hashed
Feeds Dragon Activity Log's tamper-evident audit when installed
`wp dragon-login-security disable-2fa <user>` if you ever lock yourself out
Dragon Login Security Pro
Enforce two-factor by role, trusted devices, risk-based re-challenge, a compliance report, and front-end customer 2FA — for Dragon Login Security.
Guides
Step-by-step guides from the team that builds it. All guides
Security
What actually stops account takeover on WordPress: lockouts that cannot be spoofed, a second factor that gates every login path including XML-RPC, and passkeys for the people who hate codes.
Security
How to roll out mandatory 2FA by role with a grace period, trusted devices so people are not challenged daily, risk-based re-challenges, and a report that proves who is enrolled.
Security
Why every multi-user WordPress site needs an audit trail, what a good one records, how a hash-chained log proves it has not been edited, and how to use it in an incident.
A quiet pointer to the Pro add-on: an Upgrade to Pro link on the Plugins screen, a one-line note at the foot of the plugin's screens, and a single dismissible notice once the plugin has done its job. Nothing in the free plugin is locked or changed, and all three disappear when Pro is active. - New `dragonloginsecurity_lockout` action fires when an address is locked out.
