WordPress Plugin
Protect WordPress logins and accounts
Guard Dog is a comprehensive WordPress security plugin for custom login URLs, two-factor authentication, passkeys, optional email sign-in links, social login, CAPTCHA protection, session management, and detailed activity logging — without a premium tier or subscription trap.
Free and open source. No pro version, no premium upsells.
- Version
- 1.9.59
- Requires WP
- 5.9+
- Tested to
- 7.1
- Requires PHP
- 8.1+
- Paid tier
- None
What it does
-
Custom login URL
Hide the default /wp-admin and /wp-login.php entry points behind your own slug to cut automated bot traffic.
-
Two-factor authentication
App-based or email-based 2FA with recovery codes, enforcement options, and frontend setup controls.
-
Passkeys
Passwordless authentication with device credentials — Face ID, Touch ID, Windows Hello, and security keys.
-
Login attempt limiting
Lock out repeated failed logins with configurable retry limits and durations, before brute-force attacks get comfortable.
-
Session management
Track active sessions, enforce limits, set timeouts, terminate remotely, and detect suspicious IP or location shifts.
-
Activity monitoring
Log security events across logins, lockouts, 2FA, CAPTCHA, sessions, social login, users, content, settings, plugins, and themes.
Every feature, in full
| Feature | What It Does for You |
|---|---|
| Custom Login URL | Hide the default /wp-admin and /wp-login.php entry points behind your own login slug to reduce automated bot traffic and brute-force attempts. |
| WordPress Login Screen Customization | Brand the native login screen with custom logo, colors, layout, links, and messaging while keeping the normal WordPress login flow intact. |
| Frontend Login Form | Use the Guard Dog Login Form block or shortcode on normal pages, with support for CAPTCHA, passkeys, social login buttons, remember-me, lost-password links, and redirects. |
| Frontend Account Security | Give logged-in users self-service controls for 2FA, passkeys, and active sessions through blocks or shortcodes designed for account dashboards and block themes. |
| Two-Factor Authentication (2FA) | Require app-based or email-based 2FA with recovery codes, enforcement options, and frontend setup controls that only show enabled methods. |
| Passkeys | Support passwordless authentication with device-based credentials such as Face ID, Touch ID, Windows Hello, and security keys. |
| Magic Login | Email an existing account a single-use sign-in link, with required two-factor checks still enforced. Offer a recovery path for users who cannot use their passkey. |
| Social Login | Let users sign in with Google, Microsoft, or Apple OAuth, with account linking, optional auto-creation, provider controls, and activity logging. |
| Multiple CAPTCHA Providers | Choose Google reCAPTCHA v2 or v3, hCaptcha, or Cloudflare Turnstile to match your site’s privacy and friction preferences. |
| Login Attempt Limiting | Lock out repeated failed login attempts with configurable retry limits and durations before brute-force attacks get comfortable. |
| Access Control + Trusted Proxies | Use IP, username, country, whitelist, and blacklist controls with proxy-aware visitor IP detection and trusted proxy CIDR ranges for CDN or load-balanced sites. |
| Session Management | Track active sessions, enforce session limits, set timeouts, remotely terminate sessions, and detect suspicious IP or location shifts. |
| User Enumeration Protection | Block common username discovery vectors across author archives, REST API requests, login errors, password reset flows, XML-RPC, registration, and more. |
| Temporary User Access | Create real WordPress users with secure, time-limited access links, login limits, role controls, and automatic cleanup. |
| Email Provider Control | Send 2FA and WordPress emails through providers such as Amazon SES, Mailgun, Resend, SendGrid, or Google Workspace/Gmail. |
| Password Policy + Email Verification | Set password strength requirements, block password reuse, and require users to verify email addresses before login when your site needs tighter account hygiene. |
| Activity Monitoring | Log security events across logins, lockouts, 2FA, CAPTCHA, sessions, social login, user changes, content changes, settings, plugins, themes, and more. |
Who it’s for
-
Bloggers and writers
Keep your personal site protected from login spam, username scraping, and brute-force noise without paying for a security suite.
-
Small business owners
Protect customer, staff, and admin accounts with stronger login controls, session visibility, and reliable security emails.
-
Membership and community sites
Give users frontend account-security tools for 2FA, passkeys, and session management without sending everyone into wp-admin.
-
Developers and agencies
Install a flexible security foundation on client sites, including blocks and shortcodes that fit custom login and account pages.
-
Sites behind CDNs or proxies
Use trusted proxy settings so IP-based security features understand the real visitor IP instead of yelling about your infrastructure.
Version 1.9.59 adds optional Magic Login email sign-in links for existing accounts, with a matching sign-in button and required two-factor checks. Login screen customization can include your theme’s header and footer, and supporting password managers are asked to remove deleted passkeys from their suggestions.
This release also fixes email-template saves and theme exports. After updating, review your customized emails, restore any missing text, re-export supported theme overrides, and send a test email. The documentation’s release notes explain which templates need attention and how to check them.