Title: SentriLog – Limit Login Attempts, Security & Activity Log Author: Rayhan Uddin Published: Fulbaana 2, 2026 Last modified: Fulbaana 2, 2026 --- Search plugins ![](https://ps.w.org/sentrilog/assets/banner-772x250.png?rev=3678792) ![](https://ps.w.org/sentrilog/assets/icon.svg?rev=3678792) # SentriLog – Limit Login Attempts, Security & Activity Log By [Rayhan Uddin](https://profiles.wordpress.org/rayetun/) [Download](https://downloads.wordpress.org/plugin/sentrilog.1.0.0.zip) * [Details](https://gax.wordpress.org/plugins/sentrilog/#description) * [Reviews](https://gax.wordpress.org/plugins/sentrilog/#reviews) * [Installation](https://gax.wordpress.org/plugins/sentrilog/#installation) * [Development](https://gax.wordpress.org/plugins/sentrilog/#developers) [Support](https://wordpress.org/support/plugin/sentrilog/) ## Description 🛡️ **SentriLog** is the free way to **stop brute-force attacks** on your WordPress login and **see exactly what is happening** at your front door. Install, activate, and you’re protected — smart per-IP lockouts, a full authentication activity log, login hardening, and instant email alerts, all with **zero configuration required**. Most attacks on WordPress start at `wp-login.php`: bots hammer it with thousands of username and password guesses. SentriLog counts every failed attempt, locks out offenders automatically, records the whole story, and lets you move the login page somewhere bots can’t find it. **Everything runs on your own site.** SentriLog makes **no external HTTP requests** and sends **no data to any third party** — every lockout, log entry, and setting stays in your own WordPress database. No account, no API key, no tracking. #### How SentriLog is built * ⚡ **Zero-config**: protection and logging start the moment you activate — sensible defaults, nothing to set up * 🔒 **Privacy-first**: no external calls, no data collection, no phone-home; your logs never leave your server * 🪶 **Lightweight**: bot detection runs only on login/authentication events, so normal visitors are never slowed down * 🧩 **Works with any login form**: hooks WordPress core auth (`authenticate`, ` wp_login_failed`, `wp_login`), so WooCommerce, membership, and custom login forms are all covered * 🌐 **Multisite compatible**: activate per-site or network-wide, each site with its own settings and log #### ⚡ Smart Brute-Force Protection Lock out attackers automatically, without locking out your real users. * 🔢 **Limit login attempts** — lock an IP after a configurable number of failed tries within a rolling time window * 📈 **Progressive lockout escalation** — repeat offenders are locked out for longer, automatically * 👥 **Per-IP + username tracking** — attempts are counted per IP and username pair, so one attacker can’t lock out everyone * 🧮 **Remaining-attempts hint** — optionally tell users how many tries remain before a lockout * 🧷 **XML-RPC protection** — detects and blocks `system.multicall` brute-force patterns * 🗂️ **Lockout manager** — view every active lockout with a live countdown, and clear one or all in a click #### 📋 Full Activity Log & Audit Trail Know who tried to get in, from where, and when. * 📝 **Every event recorded** — login successes, failures, logouts, lockouts, and password events, each with IP address, username, user-agent, and timestamp * 🔍 **Filter and search** — narrow the log by event type, username, IP, or date range * ⬇️ **CSV export** — download the activity log (respecting your current filters) for audits or spreadsheets * 🧹 **Retention & auto-cleanup** — set how long logs are kept (90 days by default); old records are pruned automatically via WP-Cron #### 🔑 Access Control **🚪 Change Login URL** Move `wp-login.php` to a secret slug of your choice and block the default endpoint, so automated attacks never even find the login form. A built-in emergency recovery link means you can never be permanently locked out. **🪄 Magic Login** Generate temporary, single-use, passwordless login links for support staff or clients. The temporary user is created on demand and removed automatically the moment the link expires or is revoked — no lingering accounts. **⏲️ Idle Session Timeout** Automatically sign out inactive users after a period you choose, so an unattended browser doesn’t become an open door. #### 🧱 Login Hardening * 🙈 **Username enumeration protection** — normalize login error messages, block`? author=N` and author-archive scans, and lock down the REST API users endpoint so attackers can’t harvest valid usernames * 🌐 **Configurable IP source** — choose exactly how visitor IPs are detected ( direct connection, Cloudflare, reverse proxy, or load balancer) so a spoofed header can’t defeat your lockouts * 🧷 **XML-RPC multicall blocking** — shut down a common amplification vector for password guessing #### 🔔 Alerts & Dashboard * ✉️ **Email alerts** — get notified after a configurable number of consecutive failures, and whenever a lockout is triggered * 📊 **At-a-glance dashboard** — logins, failures, and lockouts over the last 24 hours and 7 days, with a 7-day trend chart (Chart.js, bundled locally — no external requests) * 🌗 **Light & dark mode** — a clean, modern admin UI with a one-click theme toggle; light by default * 🧰 **Tabbed settings** — Lockout, Security, Logging, and Notifications, each with sensible defaults #### 🔒 Privacy First SentriLog is built to protect your users’ privacy as well as your site: * Makes **no external HTTP requests** — nothing is ever sent off your server * Stores data **only in your own database** to enforce lockouts and provide an audit trail * Cleans up completely on uninstall — drops its tables, deletes its options, removes any temporary Magic Login users, and clears its scheduled events * A `rayetun_lsn_anonymise_ip` filter is available if you want to anonymize stored IP addresses #### 👩‍💻 For Developers SentriLog is built on WordPress standards and exposes hooks so you can extend it: * `rayetun_login_sentinel_event_logged( $event_type, $user_id, $username, $ip, $extra_data )` — fires after every logged event * `rayetun_login_sentinel_lockout_triggered( $ip, $username, $duration, $attempt_count)`— fires when an IP is locked out * `rayetun_login_sentinel_should_lockout( $should_check, $ip, $username )` — short- circuit the lockout check (e.g. for an allowlist) * `rayetun_lsn_anonymise_ip` — filter stored IP addresses for anonymization ### Credits SentriLog is built and maintained by [Md Rayhan Uddin](https://rayetun.com/). This plugin bundles the following open-source library, served locally from the plugin— no external requests are made to load it: * **Chart.js** v4.5.1 — used to render the dashboard trend chart. Copyright (c) Chart.js Contributors, [MIT License](https://github.com/chartjs/Chart.js/blob/master/LICENSE.md). Project: https://www.chartjs.org Thank you to the WordPress community and to everyone who reports issues and suggests features on the [support forum](https://wordpress.org/support/plugin/sentrilog/). ## Screenshots [⌊Dashboard — at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart.⌉⌊Dashboard — at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart.⌉[ Dashboard — at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart. [⌊Activity Log — filterable, badge-coded table of every authentication event with IP, username, and timestamp.⌉⌊Activity Log — filterable, badge-coded table of every authentication event with IP, username, and timestamp.⌉[ Activity Log — filterable, badge-coded table of every authentication event with IP, username, and timestamp. [⌊Lockouts Manager — view active lockouts with live countdown timers and clear them individually or all at once.⌉⌊Lockouts Manager — view active lockouts with live countdown timers and clear them individually or all at once.⌉[ Lockouts Manager — view active lockouts with live countdown timers and clear them individually or all at once. [⌊Settings — Lockout: configure attempt limits, time window, lockout duration, and progressive escalation.⌉⌊Settings — Lockout: configure attempt limits, time window, lockout duration, and progressive escalation.⌉[ Settings — Lockout: configure attempt limits, time window, lockout duration, and progressive escalation. [⌊Settings — Security: change the login URL, harden against username enumeration, and set the client IP source.⌉⌊Settings — Security: change the login URL, harden against username enumeration, and set the client IP source.⌉[ Settings — Security: change the login URL, harden against username enumeration, and set the client IP source. [⌊Settings — Notifications: choose the alert email and the conditions that trigger it.⌉⌊Settings — Notifications: choose the alert email and the conditions that trigger it.⌉[ Settings — Notifications: choose the alert email and the conditions that trigger it. [⌊Magic Login — generate temporary, single-use, passwordless login links.⌉⌊Magic Login — generate temporary, single-use, passwordless login links.⌉[ Magic Login — generate temporary, single-use, passwordless login links. ## Installation 1. Upload the `sentrilog` folder to `/wp-content/plugins/`, or install directly through** Plugins Add New**. 2. Activate the plugin through the **Plugins** screen in WordPress. 3. Go to **SentriLog Dashboard** to watch your login activity in real time. No configuration is required to get started — SentriLog begins limiting login attempts and logging events immediately after activation. Fine-tune attempt limits, hardening, and email alerts any time under **SentriLog Settings**. ## FAQ ### ❓ Will this plugin lock me out of my own site? It can, if you enter the wrong credentials too many times. If it happens, you have three easy ways back in: use the **Change Login URL** emergency recovery link, temporarily deactivate the plugin by renaming its folder over FTP/SSH, or remove the lockout in your database with `DELETE FROM wp_rayetun_lsn_lockouts WHERE ip_address = 'YOUR_IP';`. ### 🌐 Does it make any external requests or send my data anywhere? No. SentriLog makes **zero external HTTP requests** and sends **no data to any third party**. Every lockout, log entry, and setting is stored only in your own WordPress database. The dashboard chart uses **Chart.js**, which is bundled locally in the plugin (MIT licensed) — no CDN, no external host. ### 🔌 Does it work with WooCommerce, membership plugins, or custom login forms? Yes. SentriLog hooks WordPress core authentication filters (`authenticate`, `wp_login_failed`,` wp_login`), which fire no matter which login form is used — WooCommerce, BuddyPress, membership plugins, and custom forms are all protected. ### 🕵️ Can I hide my login page? Yes. The **Change Login URL** feature moves `wp-login.php` to a secret slug you choose and blocks the default endpoint, so bots can’t find the form. An emergency recovery link makes sure you can always get back in. ### 🪄 What is Magic Login? Magic Login creates a temporary, single-use, passwordless login link you can hand to support staff or a client. The temporary user is removed automatically when the link expires or you revoke it — no leftover accounts. ### 🛡️ Does it protect XML-RPC? Yes. SentriLog detects `system.multicall` brute-force patterns and blocks that request, closing a common password-guessing amplification vector. ### 📜 Is it GDPR-friendly? SentriLog stores IP addresses in your own database to enforce lockouts and keep an audit trail — IP addresses can be personal data, so you should disclose this in your site’s privacy policy. Nothing is ever transmitted to us or any third party, logs are auto-deleted after your chosen retention period, and a `rayetun_lsn_anonymise_ip` filter is available if you want to anonymize stored IPs. ### 📤 Can I export the activity log? Yes. Export the activity log to CSV directly from the **Activity Log** screen, respecting whatever filters you have applied. ### 🌍 Does it work on WordPress Multisite? Yes. When network-activated, SentriLog creates its tables for each sub-site, and each site keeps its own independent settings and log. ### ♻️ What happens when I uninstall? Everything is cleaned up: all custom tables are dropped, plugin options are deleted, any temporary Magic Login users are removed, and scheduled events are cleared. Nothing is left behind. ### 💬 Get support Post in the [WordPress.org support forum](https://wordpress.org/support/plugin/sentrilog/). We aim to respond within 24 hours on business days. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SentriLog – Limit Login Attempts, Security & Activity Log” is open source software. The following people have contributed to this plugin. Contributors * [ Rayhan Uddin ](https://profiles.wordpress.org/rayetun/) [Translate “SentriLog – Limit Login Attempts, Security & Activity Log” into your language.](https://translate.wordpress.org/projects/wp-plugins/sentrilog) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/sentrilog/), check out the [SVN repository](https://plugins.svn.wordpress.org/sentrilog/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/sentrilog/) by [RSS](https://plugins.trac.wordpress.org/log/sentrilog/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 🎉 1.0.0 * Initial release. * Limit login attempts with configurable max attempts, rolling time window, and lockout duration. * Progressive lockout escalation for repeat offenders, tracked per IP + username. * Full authentication activity log (logins, failures, logouts, lockouts, password events) with filtering and CSV export. * Change Login URL — hide wp-login.php behind a custom slug with an emergency recovery link. * Magic Login — temporary, single-use, passwordless login links that clean themselves up. * Username enumeration protection — login error normalization, author-scan blocking, and REST API users lockdown. * Idle session timeout with a JavaScript heartbeat. * Configurable client IP source (direct, Cloudflare, reverse proxy, load balancer) to prevent header spoofing. * XML-RPC system.multicall brute-force protection. * Email alerts on repeated failures and on lockout. * Admin dashboard with stats, a 7-day trend chart (Chart.js, bundled locally), the activity log, and the lockout manager. * Light and dark admin theme with a one-click toggle. * Tabbed settings: Lockout, Security, Logging, Notifications. * WP-Cron–powered log retention and expired-lockout cleanup. * WordPress Multisite compatible. * Makes no external requests and collects no data — everything stays in your database. * Full internationalization support via the bundled `.pot` file. ## Meta * Version **1.0.0** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 8.0 or higher ** * Language * [English (US)](https://wordpress.org/plugins/sentrilog/) * Tags * [Activity Log](https://gax.wordpress.org/plugins/tags/activity-log/)[Brute Force](https://gax.wordpress.org/plugins/tags/brute-force/) [hide login url](https://gax.wordpress.org/plugins/tags/hide-login-url/)[limit login attempts](https://gax.wordpress.org/plugins/tags/limit-login-attempts/) [login security](https://gax.wordpress.org/plugins/tags/login-security/) * [Advanced View](https://gax.wordpress.org/plugins/sentrilog/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/sentrilog/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/sentrilog/reviews/) ## Contributors * [ Rayhan Uddin ](https://profiles.wordpress.org/rayetun/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/sentrilog/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://wise.com/pay/me/mdrayhanu2)