SSF LOGIN GUARD · FREE + PRO
Protect access.
Keep recovery simple.
Limit repeated password guesses, add an authenticator and give authorized owners a clear way back in. Local WordPress protection with practical staff and store workflows.
WordPress 6.6+ · PHP 8.1+ · Single-site WordPress
Observe before enforcing
Review potential restrictions, confirm proxy settings and test real login flows before blocking attempts.
Temporary limits
Separate account/address and address-wide budgets reduce repeated guesses. Blocked requests do not keep extending the same restriction.
Recovery stays practical
One-use authenticator recovery codes, administrator unlock and hosting recovery help authorized users regain access.
Free and Pro: what you get
| Feature | Free | Pro add-on |
|---|---|---|
| Temporary account + address and address-wide limits | Included | Included through Free |
| Observation mode and trusted-proxy settings | Included | Included through Free |
| Optional authenticator and one-use recovery codes | Included | Included through Free |
| Local event log, grouped hourly email alerts and hosting recovery | Included | Included through Free |
| Different staff and WooCommerce customer limits | — | Included |
| Required staff MFA with enrollment grace | — | Included |
| Staff enrollment overview | — | Up to 200 staff accounts |
| Configuration history | — | Last 20 saved changes |
| Grouped daily email / Slack / Discord summaries | — | Included, opt-in |
| Assisted recovery with administrator password + MFA | — | Included |
| Hosted agency dashboard, cloud threat network or firewall | Not included | Not included |
Pro is a separate add-on and requires Free to remain active. Customers can enroll MFA voluntarily; the Pro staff enrollment rule is limited to administrator, editor and shop-manager roles.
Simple plans
Free
$0
Core login protection, voluntary MFA, recovery codes and local events. No SSF account required.
Download Free 1.0.0Pro · 1 site
$29 / year
Pro add-on, updates and support for one site for one year.
Ask about ProPro · 10 sites
$99 / year
The same Pro feature set, with updates and support for up to ten sites for one year.
Ask about ProPrices are in USD. Renewal is manual. Installed features continue after the support period; there is no expiry switch that disables protection. Plans cover updates and support; the plugin code is GPL-2.0-or-later. Online checkout is not enabled yet—contact SSF for Pro availability and purchasing arrangements.
Get started safely
- Back up the site and confirm you can access your hosting account.
- Upload the Free ZIP through Plugins → Add Plugin → Upload Plugin, then activate it.
- Open Login Guard. Review the detected address and start in observation mode.
- Read recovery instructions and test separate administrator and customer logins while keeping your administrator session open.
- Enable enforcement when ready. Users can enroll an authenticator from their profile or WooCommerce account security link.
- For Pro, install the separate add-on alongside Free, notify staff and then configure role policies.
Designed around local data
Free makes no external service calls and needs no cloud account. Local events pseudonymize addresses and submitted account identifiers. Authorized action records can contain user IDs; logs are still site data, not anonymous research data. Retention is adjustable and storage is bounded.
Pro reports are off until configured. Optional Slack or Discord summaries include site URL, report time and grouped event counts. They do not send passwords, authenticator seeds, recovery codes, usernames or IP addresses. Delivery depends on site scheduling, mail, networking and the receiving service.
Common questions
What happens if a legitimate customer is restricted?
They can wait for expiry or use another network when an address restriction applies. An authorized administrator can clear temporary limits. WordPress password reset stays available. Enrolled MFA is still required.
What if an authenticator is lost?
Use an unused recovery code. If none remains, an authorized hosting administrator can use the documented WP-CLI recovery command. Pro also allows a different verified administrator with MFA to open a one-hour reenrollment window. The WordPress password remains required and target sessions are revoked.
Has this been tested?
Release 1.0.0 was tested on local WordPress 6.6 and 7.1.4, PHP 8.1.34 and 8.3.35, including core and WooCommerce login forms, proxy handling, counter pressure, code replay, recovery, permissions, ZIP installation and removal. The Free package passed WordPress Plugin Check. These scoped tests do not certify every hosting or plugin combination.
Is this already approved on WordPress.org?
No. This is the SSF website release. A WordPress.org listing or approval is not claimed.
Watch the setup and recovery tutorial
See Observe mode, login limits, account security and recovery settings in a local WordPress demonstration. Narration uses a stock synthetic voice.
Help and documentation
Contact SSF · Product support · All SSF WordPress plugins
Do not send passwords, authenticator setup keys or recovery codes with a support enquiry.