Adds Cloudflare Turnstile as a privacy-first alternative to Google reCAPTCHA. Your existing CAPTCHA settings are kept.<\/p>","1.1.0":"
Adds optional Google reCAPTCHA for your login and related forms (off by default; bring your own keys).<\/p>","1.0.1":"
Adds optional two-factor authentication (authenticator app + backup codes). Enable it under Users \u2192 Profile.<\/p>","1.0.0":"
Initial release. No upgrade steps needed.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3678792,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3678792,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3678792,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3678792,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3678792,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1","1.1.0","1.2.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3678792,"resolution":"1","location":"assets","locale":"","width":1712,"height":1465},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3678792,"resolution":"2","location":"assets","locale":"","width":1708,"height":1410},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3678792,"resolution":"3","location":"assets","locale":"","width":1709,"height":1261},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3678792,"resolution":"4","location":"assets","locale":"","width":1718,"height":1440},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3678792,"resolution":"5","location":"assets","locale":"","width":1715,"height":1843},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3678792,"resolution":"6","location":"assets","locale":"","width":1713,"height":1240},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3678792,"resolution":"7","location":"assets","locale":"","width":1715,"height":1312}},"screenshots":{"1":"Dashboard \u2014 at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart.","2":"Activity Log \u2014 filterable, badge-coded table of every authentication event with IP, username, and timestamp.","3":"Lockouts Manager \u2014 view active lockouts with live countdown timers and clear them individually or all at once.","4":"Settings \u2014 Lockout: configure attempt limits, time window, lockout duration, and progressive escalation.","5":"Settings \u2014 Security: change the login URL, harden against username enumeration, and set the client IP source.","6":"Settings \u2014 Notifications: choose the alert email and the conditions that trigger it.","7":"Magic Login \u2014 generate temporary, single-use, passwordless login links."}},"plugin_section":[],"plugin_tags":[8531,2439,161905,9374,1229],"plugin_category":[],"plugin_contributors":[263109],"plugin_business_model":[],"class_list":["post-361311","plugin","type-plugin","status-publish","hentry","plugin_tags-activity-log","plugin_tags-brute-force","plugin_tags-hide-login-url","plugin_tags-limit-login-attempts","plugin_tags-login-security","plugin_contributors-rayetun","plugin_committers-rayetun"],"banners":{"banner":"https:\/\/ps.w.org\/sentrilog\/assets\/banner-772x250.png?rev=3678792","banner_2x":"https:\/\/ps.w.org\/sentrilog\/assets\/banner-1544x500.png?rev=3678792","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/sentrilog\/assets\/icon.svg?rev=3678792","icon":"https:\/\/ps.w.org\/sentrilog\/assets\/icon.svg?rev=3678792","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/sentrilog\/assets\/screenshot-1.png?rev=3678792","caption":"Dashboard \u2014 at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart."},{"src":"https:\/\/ps.w.org\/sentrilog\/assets\/screenshot-2.png?rev=3678792","caption":"Activity Log \u2014 filterable, badge-coded table of every authentication event with IP, username, and timestamp."},{"src":"https:\/\/ps.w.org\/sentrilog\/assets\/screenshot-3.png?rev=3678792","caption":"Lockouts Manager \u2014 view active lockouts with live countdown timers and clear them individually or all at once."},{"src":"https:\/\/ps.w.org\/sentrilog\/assets\/screenshot-4.png?rev=3678792","caption":"Settings \u2014 Lockout: configure attempt limits, time window, lockout duration, and progressive escalation."},{"src":"https:\/\/ps.w.org\/sentrilog\/assets\/screenshot-5.png?rev=3678792","caption":"Settings \u2014 Security: change the login URL, harden against username enumeration, and set the client IP source."},{"src":"https:\/\/ps.w.org\/sentrilog\/assets\/screenshot-6.png?rev=3678792","caption":"Settings \u2014 Notifications: choose the alert email and the conditions that trigger it."},{"src":"https:\/\/ps.w.org\/sentrilog\/assets\/screenshot-7.png?rev=3678792","caption":"Magic Login \u2014 generate temporary, single-use, passwordless login links."}],"raw_content":"\n
\ud83d\udee1\ufe0f SentriLog<\/strong> is the free way to stop brute-force attacks<\/strong> on your WordPress login and see exactly what is happening<\/strong> at your front door. Install, activate, and you're protected \u2014 smart per-IP lockouts, a full authentication activity log, login hardening, and instant email alerts, all with zero configuration required<\/strong>.<\/p>\n\n Most attacks on WordPress start at Everything runs on your own site by default.<\/strong> SentriLog makes no external HTTP requests<\/strong> out of the box \u2014 every lockout, log entry, and setting stays in your own WordPress database. No account, no tracking. The one optional exception is the CAPTCHA integration (Google reCAPTCHA or Cloudflare Turnstile), which stays off until you add your own keys (fully disclosed under External Services below).<\/p>\n\n Lock out attackers automatically, without locking out your real users.<\/p>\n\n Know who tried to get in, from where, and when.<\/p>\n\n \ud83d\udeaa Change Login URL<\/strong>\nMove \ud83e\ude84 Magic Login<\/strong>\nGenerate temporary, single-use, passwordless login links for support staff or clients. The temporary user is created on demand and removed automatically the moment the link expires or is revoked \u2014 no lingering accounts.<\/p>\n\n \u23f2\ufe0f Idle Session Timeout<\/strong>\nAutomatically sign out inactive users after a period you choose, so an unattended browser doesn't become an open door.<\/p>\n\n Add a second layer to any account \u2014 no external service, no account required.<\/p>\n\n Add a CAPTCHA to your login, lost-password, and registration forms to stop bots before they ever reach your credentials. Off by default<\/strong> \u2014 bring your own free keys to switch it on.<\/p>\n\n CAPTCHA is the only part of SentriLog that contacts an external service \u2014 see the External Services<\/strong> section for the full data disclosure.<\/p>\n\n SentriLog is built to protect your users' privacy as well as your site:<\/p>\n\n SentriLog is built on WordPress standards and exposes hooks so you can extend it:<\/p>\n\n SentriLog is fully functional on its own \u2014 Pro is an optional upgrade for teams and agencies that want more. It adds, among other things:<\/p>\n\n Every plan includes a 14-day free trial. Open SentriLog \u2192 Go Pro<\/strong> in your dashboard for the full list and pricing.<\/p>\n\n SentriLog is self-contained and, by default, makes no external requests. Its optional CAPTCHA feature can use one<\/strong> of two third-party providers, both disabled by default<\/strong> and used only if you choose to turn one on. You pick the provider and supply your own keys.<\/p>\n\n If you select Google reCAPTCHA under SentriLog \u2192 Settings \u2192 CAPTCHA<\/strong> and enter your own keys, SentriLog protects the login, lost-password, and\/or registration forms you select with Google reCAPTCHA, a bot-detection service provided by Google.<\/p>\n\n If you select Cloudflare Turnstile under SentriLog \u2192 Settings \u2192 CAPTCHA<\/strong> and enter your own keys, SentriLog protects the forms you select with Cloudflare Turnstile, a privacy-first bot-detection service provided by Cloudflare that does not track users or serve interactive image challenges.<\/p>\n\n If you never enable CAPTCHA, SentriLog makes no external requests at all.<\/p>\n\n SentriLog is built and maintained by Md Rayhan Uddin<\/a>.<\/p>\n\n This plugin bundles the following open-source library, served locally from the plugin \u2014 no external requests are made to load it:<\/p>\n\n Thank you to the WordPress community and to everyone who reports issues and suggests features on the support forum<\/a>.<\/p>\n\n\n No configuration is required to get started \u2014 SentriLog begins limiting login attempts and logging events immediately after activation. Fine-tune attempt limits, hardening, and email alerts any time under SentriLog \u2192 Settings<\/strong>.<\/p>\n\n\n It can, if you enter the wrong credentials too many times. If it happens, you have three easy ways back in: use the Change Login URL<\/strong> emergency recovery link, temporarily deactivate the plugin by renaming its folder over FTP\/SSH, or remove the lockout in your database with By default, no \u2014 SentriLog makes zero external HTTP requests<\/strong> and stores everything in your own WordPress database. The dashboard chart uses Chart.js<\/strong>, bundled locally (MIT licensed) \u2014 no CDN. The one exception is the optional CAPTCHA<\/strong> integration: it stays off until you add your own Google reCAPTCHA or Cloudflare Turnstile keys, and when enabled it verifies protected form submissions with your chosen provider. See the External Services section below for exactly what is sent.<\/p><\/dd>\n Yes. SentriLog hooks WordPress core authentication filters ( Yes. The Change Login URL<\/strong> feature moves Magic Login creates a temporary, single-use, passwordless login link you can hand to support staff or a client. The temporary user is removed automatically when the link expires or you revoke it \u2014 no leftover accounts.<\/p><\/dd>\n Go to Users \u2192 Profile<\/strong> and scroll to the Two-Factor Authentication<\/strong> section. Scan the QR code with any authenticator app, enter the 6-digit code to confirm, and save your profile. You'll be shown a set of backup codes once \u2014 store them somewhere safe. From then on, you'll enter a code from your app each time you log in. To turn it off, tick \"Disable two-factor authentication\" on the same screen and save. (Trusted devices, email codes, and requiring 2FA for whole roles are available in the Pro add-on.)<\/p><\/dd>\n Yes. SentriLog detects SentriLog stores IP addresses in your own database to enforce lockouts and keep an audit trail \u2014 IP addresses can be personal data, so you should disclose this in your site's privacy policy. Nothing is ever transmitted to us, logs are auto-deleted after your chosen retention period, and a It's completely optional and off by default. To turn it on, go to SentriLog \u2192 Settings \u2192 CAPTCHA<\/strong>, pick a provider \u2014 Google reCAPTCHA (get keys<\/a>) or Cloudflare Turnstile (get keys<\/a>) \u2014 paste your Site Key and Secret Key, choose which forms to protect, and save. Until you add your keys, CAPTCHA does nothing and no data is sent anywhere. See the External Services section for exactly what is shared.<\/p><\/dd>\n Yes. Export the activity log to CSV directly from the Activity Log<\/strong> screen, respecting whatever filters you have applied.<\/p><\/dd>\n Yes. When network-activated, SentriLog creates its tables for each sub-site, and each site keeps its own independent settings and log.<\/p><\/dd>\n Everything is cleaned up: all custom tables are dropped, plugin options are deleted, any temporary Magic Login users are removed, and scheduled events are cleared. Nothing is left behind.<\/p><\/dd>\nwp-login.php<\/code>: bots hammer it with thousands of username and password guesses. SentriLog counts every failed attempt, locks out offenders automatically, records the whole story, and lets you move the login page somewhere bots can't find it.<\/p>\n\nHow SentriLog is built<\/h4>\n\n
\n
authenticate<\/code>, wp_login_failed<\/code>, wp_login<\/code>), so WooCommerce, membership, and custom login forms are all covered<\/li>\n\u26a1 Smart Brute-Force Protection<\/h4>\n\n
\n
system.multicall<\/code> brute-force patterns<\/li>\n\ud83d\udccb Full Activity Log & Audit Trail<\/h4>\n\n
\n
\ud83d\udd11 Access Control<\/h4>\n\n
wp-login.php<\/code> to a secret slug of your choice and block the default endpoint, so automated attacks never even find the login form. A built-in emergency recovery link means you can never be permanently locked out.<\/p>\n\n\ud83d\udd10 Two-Factor Authentication<\/h4>\n\n
\n
\ud83e\uddf1 Login Hardening<\/h4>\n\n
\n
?author=N<\/code> and author-archive scans, and lock down the REST API users endpoint so attackers can't harvest valid usernames<\/li>\n\ud83e\udd16 CAPTCHA (optional)<\/h4>\n\n
\n
\ud83d\udd14 Alerts & Dashboard<\/h4>\n\n
\n
\ud83d\udd12 Privacy First<\/h4>\n\n
\n
rayetun_lsn_anonymise_ip<\/code> filter is available if you want to anonymize stored IP addresses<\/li>\n<\/ul>\n\n\ud83d\udc69\u200d\ud83d\udcbb For Developers<\/h4>\n\n
\n
rayetun_login_sentinel_event_logged( $event_type, $user_id, $username, $ip, $extra_data )<\/code> \u2014 fires after every logged event<\/li>\nrayetun_login_sentinel_lockout_triggered( $ip, $username, $duration, $attempt_count )<\/code> \u2014 fires when an IP is locked out<\/li>\nrayetun_login_sentinel_should_lockout( $should_check, $ip, $username )<\/code> \u2014 short-circuit the lockout check (e.g. for an allowlist)<\/li>\nrayetun_lsn_anonymise_ip<\/code> \u2014 filter stored IP addresses for anonymization<\/li>\nrayetun_login_sentinel_2fa_verified( $user_id )<\/code> \u2014 fires after a user passes two-factor verification<\/li>\n<\/ul>\n\nUpgrade to SentriLog Pro<\/h3>\n\n
\n
External Services<\/h3>\n\n
Google reCAPTCHA<\/h4>\n\n
\n
https:\/\/www.google.com\/recaptcha\/api.js<\/code> and tokens are verified at https:\/\/www.google.com\/recaptcha\/api\/siteverify<\/code>.<\/li>\nCloudflare Turnstile<\/h4>\n\n
\n
https:\/\/challenges.cloudflare.com\/turnstile\/v0\/api.js<\/code> and tokens are verified at https:\/\/challenges.cloudflare.com\/turnstile\/v0\/siteverify<\/code>.<\/li>\nCredits<\/h3>\n\n
\n
\n
sentrilog<\/code> folder to \/wp-content\/plugins\/<\/code>, or install directly through Plugins \u2192 Add New<\/strong>.<\/li>\n\n
\u2753 Will this plugin lock me out of my own site?<\/h3><\/dt>\n
DELETE FROM wp_rayetun_lsn_lockouts WHERE ip_address = 'YOUR_IP';<\/code>.<\/p><\/dd>\n\ud83c\udf10 Does it make any external requests or send my data anywhere?<\/h3><\/dt>\n
\ud83d\udd0c Does it work with WooCommerce, membership plugins, or custom login forms?<\/h3><\/dt>\n
authenticate<\/code>, wp_login_failed<\/code>, wp_login<\/code>), which fire no matter which login form is used \u2014 WooCommerce, BuddyPress, membership plugins, and custom forms are all protected.<\/p><\/dd>\n\ud83d\udd75\ufe0f Can I hide my login page?<\/h3><\/dt>\n
wp-login.php<\/code> to a secret slug you choose and blocks the default endpoint, so bots can't find the form. An emergency recovery link makes sure you can always get back in.<\/p><\/dd>\n\ud83e\ude84 What is Magic Login?<\/h3><\/dt>\n
\ud83d\udd10 How do I turn on two-factor authentication?<\/h3><\/dt>\n
\ud83d\udee1\ufe0f Does it protect XML-RPC?<\/h3><\/dt>\n
system.multicall<\/code> brute-force patterns and blocks that request, closing a common password-guessing amplification vector.<\/p><\/dd>\n\ud83d\udcdc Is it GDPR-friendly?<\/h3><\/dt>\n
rayetun_lsn_anonymise_ip<\/code> filter is available if you want to anonymize stored IPs. If you enable the optional CAPTCHA, visitor IPs are also sent to your chosen provider (Google or Cloudflare) for verification \u2014 see External Services below.<\/p><\/dd>\n\ud83e\udd16 How do I enable CAPTCHA, and is it required?<\/h3><\/dt>\n
\ud83d\udce4 Can I export the activity log?<\/h3><\/dt>\n
\ud83c\udf0d Does it work on WordPress Multisite?<\/h3><\/dt>\n
\u267b\ufe0f What happens when I uninstall?<\/h3><\/dt>\n
\ud83d\udcac Get support<\/h3><\/dt>\n