Cybex Login Security puts a limit on failed attempts, a CAPTCHA in front of the form and your login page somewhere the bots aren't looking — then records every attempt so you can see who is trying.
Nobody picks your site personally. Scanners walk lists of domains, try the usual usernames against the usual path, and move on when it costs them anything. The point is to make it cost something.
Every WordPress site answers on the same path, so a scanner does not need to find you first.
Core puts no cap on failed passwords. A weak one falls to a script that never gets tired.
Without a log there is nothing to show whether an attempt succeeded, or which account was targeted.
Each module handles one job and can be switched on by itself. Turn on what your site needs and leave the rest alone.
Cap failed logins per IP and per username, then lock the pair out for as long as you choose. Repeat offenders get longer.
Google reCAPTCHA v2 or v3, Cloudflare Turnstile, or a self-hosted challenge that calls no third party at all.
Serve the form from a path only you know. Requests to wp-login.php stop resolving, which is most of the automated traffic gone.
Block a single address or a whole range, or invert it — restrict wp-admin to the office IPs and nothing else gets in.
Set length and complexity, expire old passwords, and reject any that appear in a known breach — checked without sending the password anywhere.
See which devices signed in to each account and when, with a summary of what was blocked over the period.
Set the cap and the lockout, then watch the counter do its work.
Pick a provider, or use the built-in challenge and call nobody.
Time-based codes from any authenticator app, enrolled by QR code.
Allow the countries you serve and refuse the login form to the rest.
Everything that stops a brute-force attack is in the free build and stays there. Pro adds the two controls that need a second factor or a data feed behind them.
No code and no server configuration. If a rule ever locks you out of your own site, an emergency link mailed to the admin address turns it off again.
From the WordPress plugin directory, or upload the Pro zip and paste your licence key.
Pick how many failed attempts you allow and how long a lockout lasts. Sensible defaults are already set.
Use the built-in challenge for no setup at all, or paste keys for reCAPTCHA or Turnstile.
Optional, and the single biggest drop in automated traffic. Save the new address before you sign out.
The price shown is what you pay — Indian orders include GST, everywhere else is tax-free. Renews at the same rate; cancel any time and the free protection keeps running.
Placeholder quote — we have not shipped long enough to have a customer say something worth printing yet.
Anything else, write to us — someone who works on the plugin will answer.
admin@cybexsoft.comEvery lockout screen offers a recovery link sent to the site administrator's email address, which clears the block and reopens the login page. If you have moved the login URL and lost the address, the same email restores it.
Yes. The protection sits on the WordPress authentication layer, so any plugin that logs a user in through core — WooCommerce accounts, membership and LMS plugins, custom front-end forms — is covered without per-plugin setup.
No. reCAPTCHA and Turnstile are supported if you want them, but the built-in challenge is served entirely from your own site and sends nothing to a third party — useful if you would rather not add an external request to your login page.
No. The policy checks a password against the Have I Been Pwned range API, which receives only the first five characters of its SHA-1 hash. The password itself never leaves your server, and neither does enough of the hash to identify it.
It can, which is why geo-blocking applies to the login form rather than the whole site, and why allow lists take an IP exception. Add the address someone is travelling from and they get through regardless of country.
Everything in the free build keeps protecting the site. Two-factor authentication and geo-blocking pause, and updates and Pro support stop until you renew. Enrolled 2FA devices are remembered, so renewing puts them straight back to work.
The free plugin takes five minutes and needs no account anywhere. Pro is a licence key away, with a fourteen-day refund if it does not help.
