SentriLog – Limit Login Attempts, Security & Activity Log

Description

🛡️ SentriLog is the free way to stop brute-force attacks on your WordPress login and see exactly what is happening at your front door. Install, activate, and you’re protected — smart per-IP lockouts, a full authentication activity log, login hardening, and instant email alerts, all with zero configuration required.

Most attacks on WordPress start at wp-login.php: bots hammer it with thousands of username and password guesses. SentriLog counts every failed attempt, locks out offenders automatically, records the whole story, and lets you move the login page somewhere bots can’t find it.

Everything runs on your own site. SentriLog makes no external HTTP requests and sends no data to any third party — every lockout, log entry, and setting stays in your own WordPress database. No account, no API key, no tracking.

How SentriLog is built

• ⚡ Zero-config: protection and logging start the moment you activate — sensible defaults, nothing to set up
• 🔒 Privacy-first: no external calls, no data collection, no phone-home; your logs never leave your server
• 🪶 Lightweight: bot detection runs only on login/authentication events, so normal visitors are never slowed down
• 🧩 Works with any login form: hooks WordPress core auth (authenticate, wp_login_failed, wp_login), so WooCommerce, membership, and custom login forms are all covered
• 🌐 Multisite compatible: activate per-site or network-wide, each site with its own settings and log

⚡ Smart Brute-Force Protection

Lock out attackers automatically, without locking out your real users.

• 🔢 Limit login attempts — lock an IP after a configurable number of failed tries within a rolling time window
• 📈 Progressive lockout escalation — repeat offenders are locked out for longer, automatically
• 👥 Per-IP + username tracking — attempts are counted per IP and username pair, so one attacker can’t lock out everyone
• 🧮 Remaining-attempts hint — optionally tell users how many tries remain before a lockout
• 🧷 XML-RPC protection — detects and blocks system.multicall brute-force patterns
• 🗂️ Lockout manager — view every active lockout with a live countdown, and clear one or all in a click

📋 Full Activity Log & Audit Trail

Know who tried to get in, from where, and when.

• 📝 Every event recorded — login successes, failures, logouts, lockouts, and password events, each with IP address, username, user-agent, and timestamp
• 🔍 Filter and search — narrow the log by event type, username, IP, or date range
• ⬇️ CSV export — download the activity log (respecting your current filters) for audits or spreadsheets
• 🧹 Retention & auto-cleanup — set how long logs are kept (90 days by default); old records are pruned automatically via WP-Cron

🔑 Access Control

🚪 Change Login URL
Move wp-login.php to a secret slug of your choice and block the default endpoint, so automated attacks never even find the login form. A built-in emergency recovery link means you can never be permanently locked out.

🪄 Magic Login
Generate temporary, single-use, passwordless login links for support staff or clients. The temporary user is created on demand and removed automatically the moment the link expires or is revoked — no lingering accounts.

⏲️ Idle Session Timeout
Automatically sign out inactive users after a period you choose, so an unattended browser doesn’t become an open door.

🧱 Login Hardening

• 🙈 Username enumeration protection — normalize login error messages, block ?author=N and author-archive scans, and lock down the REST API users endpoint so attackers can’t harvest valid usernames
• 🌐 Configurable IP source — choose exactly how visitor IPs are detected (direct connection, Cloudflare, reverse proxy, or load balancer) so a spoofed header can’t defeat your lockouts
• 🧷 XML-RPC multicall blocking — shut down a common amplification vector for password guessing

🔔 Alerts & Dashboard

• ✉️ Email alerts — get notified after a configurable number of consecutive failures, and whenever a lockout is triggered
• 📊 At-a-glance dashboard — logins, failures, and lockouts over the last 24 hours and 7 days, with a 7-day trend chart (Chart.js, bundled locally — no external requests)
• 🌗 Light & dark mode — a clean, modern admin UI with a one-click theme toggle; light by default
• 🧰 Tabbed settings — Lockout, Security, Logging, and Notifications, each with sensible defaults

🔒 Privacy First

SentriLog is built to protect your users’ privacy as well as your site:

• Makes no external HTTP requests — nothing is ever sent off your server
• Stores data only in your own database to enforce lockouts and provide an audit trail
• Cleans up completely on uninstall — drops its tables, deletes its options, removes any temporary Magic Login users, and clears its scheduled events
• A rayetun_lsn_anonymise_ip filter is available if you want to anonymize stored IP addresses

👩‍💻 For Developers

SentriLog is built on WordPress standards and exposes hooks so you can extend it:

• rayetun_login_sentinel_event_logged( $event_type, $user_id, $username, $ip, $extra_data ) — fires after every logged event
• rayetun_login_sentinel_lockout_triggered( $ip, $username, $duration, $attempt_count ) — fires when an IP is locked out
• rayetun_login_sentinel_should_lockout( $should_check, $ip, $username ) — short-circuit the lockout check (e.g. for an allowlist)
• rayetun_lsn_anonymise_ip — filter stored IP addresses for anonymization

Credits

SentriLog is built and maintained by Md Rayhan Uddin.

This plugin bundles the following open-source library, served locally from the plugin — no external requests are made to load it:

• Chart.js v4.5.1 — used to render the dashboard trend chart. Copyright (c) Chart.js Contributors, MIT License. Project: https://www.chartjs.org

Thank you to the WordPress community and to everyone who reports issues and suggests features on the support forum.