User Security Guard for WordPress

Not by default. Administrator accounts are never auto-blocked unless you switch that on, and allowlisting your own IP address removes the risk. If you are locked out anyway, run wp wpus unblock –account=your-login from the command line, or use password reset, which is never blocked.

It does one thing. There is no file scanning, no firewall and no hardening score. It protects accounts and sign-ins; pair it with a malware scanner if you need that too.

No. On ordinary page views the plugin does no database work. Its queries run only on login, XML-RPC, REST authentication and application-password requests, and rate counters live in transients. On a sign-up it also looks up the email domain once, and remembers the answer for 12 hours.

It is a legacy endpoint that amplifies credential stuffing and is almost never needed. If Jetpack, the mobile app or another tool uses it, turn it back on under Settings → XML-RPC.

No. All bot signals combined are capped below the block threshold, so a normal browser with normal headers is never blocked on bot grounds alone.

Yes, but you must tell it. Turn on Trust proxy headers and choose the header your proxy sets. It is off by default because those headers are easy to fake when there is no proxy in front. The Tools screen shows which address the plugin sees for you and names the header to choose.

Then no address reaches a limit, so the plugin counts the different addresses of one network instead. When 10 different addresses of one IPv4 /24 (IPv6 /64) are refused or try names that are not accounts, the whole network is blocked. A bot that also hops between neighbouring networks is caught one level up: 25 addresses spread over at least three networks block the /20 (IPv6 /48) around them. The Dashboard card “What the recorded attempts show” tells you in plain words what is happening and offers Block network or Block range.

It refuses sign-ins from that network or range, never browsing or guest checkout. Before blocking, the plugin leaves a network alone when somebody signed in successfully from it in the last 90 days, when a trusted address or Allowlist entry is inside it, or when the successful sign-ins of customers are not logged (then the rule is paused). A wide range lifts by itself after 48 hours, you can unblock it at any moment, and an address on your Allowlist is never refused because of it.

Not by default, with one exception. A block lasts until an administrator removes it. You can opt in to releasing automatic blocks after a number of hours. Blocks you make by hand and permanent blocks never lift on their own. The exception is a wide range (an IPv4 /20 or /16, an IPv6 /48 or /32) that the plugin blocked by itself: it lifts after 48 hours, because a wrong guess there refuses thousands of people. You can change the hours, or set 0 to keep it until you unblock it.

Yes, if you turn on automatic release. Set the multiplier under Settings → Blocking behaviour, and each time the same address or account is blocked again after the release, the block lasts that many times longer than the last one, never more than a year. A block you lifted by hand, or an address that stayed away for longer than the repeat-offender memory, starts again at the base length.

Yes, and it finds WooCommerce by itself. Wrong passwords on My Account and the checkout login are counted and blocked like wp-login.php. Browsing the shop is never scored. You can switch it off under Settings → WooCommerce sign-in. Since 1.7.0 the My Account registration form gets Sign-up protection too; accounts created at checkout are never checked.

Yes. A blocked IP address or account cannot authenticate with an application password, and every REST credential failure gets the same generic answer. Only requests that carry credentials are looked at.

It is optional and off by default. When on, it is asked on every sign-in form for the roles you tick, from a browser the plugin does not recognise. Because it can refuse a correct password when mail does not work, use the test email button first. wp wpus two-factor –disable is the way back in.

No. It only looks at requests WordPress already answered with a 404 for a known probe path, and the only consequence is a block on sign-ins from that address. Signed-in editors, allowlisted addresses and shared addresses such as a CDN edge are never counted.

Open User Security → Emails. The master switch at the top turns every alert and the digest off; below it every email the plugin can send is listed with its own switch and one line that says when it is sent, with the address they go to, the repeat window and the accounts to watch. The sign-in code has no switch there because it is part of two-factor authentication, which you switch off under Settings.

One, by default: a weekly security digest to the notification address. It lists failed sign-ins, new blocks, the busiest addresses, the accounts most often targeted and a threat level. It is sent only while email notifications are on, and the first one arrives one full period after the daily job first sees it switched on. Choose daily, weekly, monthly or never under Settings → Notifications. Tools has a Send a digest now button, wp wpus digest prints one and wp wpus digest –send emails it.

Each email is a card with the plugin icon and your site name at the top, a coloured label for how serious it is, a headline, the facts in a table (IP address, account, role, which sign-in form, time), advice on what to do next and a button that opens the right screen: the blocked addresses, or the security log filtered to that address or account. The sign-in code is shown large, so it is easy to read and copy. Every email also carries a plain-text version for mail apps that prefer it, and nothing is loaded from a server, so nothing is blocked and nothing tracks the reader. Developers can change any email with the wpus_email_message filter, or send plain text only with wpus_email_html.

You can, but two plugins that count the same failed sign-ins and lock addresses can lock the wrong person out and double the alerts. If another login-limiting plugin is active, Settings and Tools name it. Keep one of them.

Yes, since 1.5.0. The tabs wrap instead of scrolling sideways, the dashboard tiles sit two to a row, the compact tables stack as labelled lines, the list tables use WordPress’s own phone layout, and Settings gets a Jump to a section select. Only the 14-day chart still scrolls sideways, because its labels would be unreadable any smaller.

Yes. On the staging site, download the settings as JSON from Tools, then paste the file into Import settings on the other site, or run wp wpus import-settings. Thirteen settings are never imported: the proxy settings, the notification address, the country rule, the sign-in code switch, emergency mode, blocking of administrator accounts, trusted administrator addresses, automatic release of blocks with its multiplier, and the uninstall choice. The result lists every setting that changed.

Only if you turn it on under Settings → Privacy. It adds a short line under the WordPress login form and the WooCommerce My Account and checkout login forms, saying that the IP address and browser details are recorded, with a link to your privacy policy. You can write your own wording.

Every sign-in form the plugin knows carries a hidden token that is valid for a day (Settings > Sign-in form check). Your form was open for longer than that, or the page came from a copy made before the plugin was switched on. Reload the page and sign in again. Bots that post credential lists without ever loading the form get the same message, which is the point.

Not if it is one of the usual kinds: wp-login.php, a form made with wp_login_form() (most themes and page builders), the WooCommerce My Account and checkout forms, or a plugin that signs people in on its own page. A hand-made form that posts straight to wp-login.php without the login_form hook is the one case: exempt it with the wpus_form_origin_required filter, or switch the check off.

Yes, since 1.7.0. Sign-up protection checks the WooCommerce My Account and the wp-login.php registration forms. An account-creation tool that does not run the page’s JavaScript, sends the form in a second, fills in a hidden field, uses a throw-away email domain or a browser years out of date, or creates many accounts from one address is refused, even when it solved the CAPTCHA. A fake account that still gets through can be marked as fake on the Users screen, which blocks what it came from and deletes it.

Rarely, and it says why. Every refusal is in Security Logs under the kind Sign-ups with the check that refused it, and the person sees the form again with a message to reload and try again. A failed DNS lookup never refuses, Safari and unknown browsers are never judged, an allowlisted address passes every check, and accounts created at checkout are never checked.

The address the account signed up from (an IP block), the mail servers its email domain runs itself and the domain (two lists under Settings > Sign-up protection), then the account is deleted. It never learns Gmail, Outlook and the other free providers, a shared mail server or your own address, and it leaves accounts with orders or content and watched roles alone. The deletion cannot be undone; what was learned can: unblock the address and delete the lines.

No. Refusals happen on wp-login.php, the shop sign-in form and xmlrpc.php, which crawlers never post to. A visitor’s ?author=1 gets the ordinary 404 page while author pages at their real addresses stay as they are, a real crawler is recognised by DNS and never counted by the exploit-probing rule, and the plugin never answers 403 for a page, a 404 or a public REST route. The plugin’s own test-suite checks that over real HTTP.

From a small file that ships with the plugin (about 5 MB, the free IP to Country Lite database by DB-IP.com, credited under the card). Each address is looked up in it on your own server, so nothing is downloaded or sent anywhere, and sign-in attempts recorded before 1.6.0 get a country too. It is a display only: the optional country rule still reads only the header your CDN or host adds. Private addresses and addresses the file does not know are listed as Unknown or private network, and a country is only as exact as such a database can be, so a VPN or a mobile network can show another country. The file is refreshed with plugin updates.

No sign-in data leaves your site. No IP address, username or login attempt is sent anywhere, and there is no tracking, online lookup or blocklist feed (the countries on the Dashboard come from a file that ships inside the plugin). Sign-up protection asks your own server’s DNS resolver about the email domain of a sign-up (the domain only, never the address). The one outside contact is the WpExperts Hub licence and update check with wpexpertshub.com. It goes through WordPress’s normal update check and the Plugins → WpExperts Hub Licences screen, its answer is cached for 12 hours, and it sends your site address, the plugin’s folder name and version and your licence key. It is never made while a sign-in is being checked, and the protection does not depend on it.

Deactivating deletes nothing. Under Settings → Privacy, Delete plugin data on uninstall is ticked by default; when it is ticked, deleting the plugin removes its tables, options, transients and the sign-up records of the accounts. Untick it first to keep your block list and logs.

Your licence key is emailed after purchase and is also shown in My Account → Downloads. In WordPress go to Plugins → WpExperts Hub Licences, paste the key and click Activate licence. New versions then appear on the normal Dashboard → Updates screen. The plugin works without a licence; the key only unlocks updates. You can also upload a new zip under Plugins → Add New → Upload Plugin and choose Replace current with uploaded. Your settings and data are kept.

Email support@wpexpertshub.com with your order details and a description of the issue, and our team will help you.