=== DadsFam Login Security ===
Contributors: dadsfam
Tags: login, security, brute force, lockout, limit login attempts
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.7.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stop brute-force attacks dead. Smart login lockouts, IP rules, a full activity log and WordPress hardening — in plain English, no manual needed.

== Description ==

**DadsFam Login Security** protects the most-attacked part of your WordPress site — the login form — without making you read a manual or fiddle with servers.

Everything described below works on every site. Nothing is disabled, blurred out, time-limited or reduced.

It watches failed logins, locks out attackers automatically, escalates repeat offenders to a longer ban, and keeps a clean log of everything so you can see exactly what's hitting your site.

= What you get (free) =

* **Smart brute-force lockouts** — set how many tries are allowed and how long the lockout lasts. Repeat offenders get an automatic extended ban.
* **IP allow & deny lists** — exact IPs, wildcards (`1.2.3.*`) and CIDR ranges (`1.2.3.0/24`). IPv4 and IPv6.
* **Full login activity log** — every failed login, success, lockout and block, with IP, username and device. Searchable, filterable, auto-pruned.
* **Live dashboard** — failed-login stats, a 14-day chart, top attacking IPs, and who's locked out right now (with one-click unblock).
* **Email alerts** — get a tidy, throttled email when a lockout triggers.
* **Generic login errors** — stop attackers learning whether a username exists.
* **Honeypot bot trap** — an invisible field that catches dumb bots.
* **Hardening** — block user enumeration (`?author=N` and the REST API), kill XML-RPC pingback amplification, or disable XML-RPC entirely.

= Pro Features (DadsFam Login Security Pro add-on) =

The optional **DadsFam Login Security Pro** add-on plugs into the same screens and adds two-factor authentication (authenticator apps and email codes, with backup codes and trusted devices), CAPTCHA on the login form (Google reCAPTCHA, hCaptcha, Cloudflare Turnstile or a built-in maths question), a custom hidden login address, a branded login screen, strong-password and breached-password checks, idle auto-logout, scheduled security reports, and country blocking.

= A word about PRO =

Right, let me be straight with you, because I hate being sold to as much as you do.

Everything above is free and it stays free. The lockouts, the allow and deny lists, the activity log, the live dashboard, the email alerts, the bot traps and the hardening — none of those are premium features. Those are the things a login-security plugin should just do, and if I put them behind a paywall I would be taking the mickey.

There is a PRO add-on. It exists because I am a dad in Cape Town, and this is one of the things that puts food on the table at my house. That is the honest reason. Not "unlock your potential", not "supercharge your workflow". Just: if this plugin kept the bots off your login page and you can spare it, PRO helps me keep building.

What PRO adds is the second layer you reach for once the door is already locked — two-factor codes, a CAPTCHA, a hidden login address, breached-password checks, country blocking. That is extra security and convenience. It is not the plugin working properly, because the plugin already works properly.

So if the free one does everything you need, brilliant. Genuinely. Use it, and I hope your activity log stays boring. If you get to the point where a second factor or a hidden login would let you sleep better, PRO is at plugins.dadsfam.co.za.

Either way, thanks for using something I built. — Zak, DadsFam

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`, or install the ZIP via **Plugins → Add New → Upload Plugin**.
2. Activate it through the **Plugins** menu.
3. Head to **Login Security** in the admin sidebar. Sensible defaults are already on — tweak the numbers under **Settings** if you like.

== Frequently Asked Questions ==

= Will this lock me out of my own site? =
It locks out by IP after repeated *failed* logins. Add your own IP to the **Allow list** under Settings to be safe. If you ever get stuck, lockouts expire on their own, or you can clear the `wp_dfls_lockouts` database table.

= Does it work behind Cloudflare or a load balancer? =
By default it uses the real connection IP (`REMOTE_ADDR`), which can't be spoofed. If you're behind a trusted proxy, you can return the forwarded header using the `dfls_client_ip` filter.

= Is it compatible with WooCommerce login forms? =
Yes — the honeypot and protection also apply to the WooCommerce login form.

= Will disabling XML-RPC break anything? =
Disabling just **pingbacks** is safe for nearly everyone. Disabling XML-RPC **completely** can affect the WordPress/Jetpack mobile app and some remote-publishing tools, so that option is off by default.

== Screenshots ==

1. The dashboard: protection status in one sentence, a finish-locking-down checklist, live stats, the 14-day chart and who is locked out right now.
2. Activity: every sign-in attempt, filtered with one click, with “Block for good” on any row.
3. Settings: pick Relaxed, Balanced or Strict, flip plain-English switches, and put your own address on the allow list with one click.

== Changelog ==

= 1.7.1 =
* Removed the small "Powered by DadsFam" line from the bottom of the lockout and new-login emails. Those emails go to your users, and nothing of ours belongs in them unless you have asked for it.
* Corrected the plugin's homepage link in its header, which pointed at a page that no longer exists.

= 1.7.0 =
* New: find any setting. A search box above the Settings cards filters every switch and field by a word in its label or description, opens the "actual numbers" section when a match is inside it, and says plainly when nothing matches.
* New: the save bar tells you. It lights up the moment something on the page changes and the browser warns before you leave with unsaved changes.
* Readme: added the standing "A word about PRO" note — what stays free, why the optional add-on exists, and what it actually adds — and the line that nothing in the free plugin is disabled, blurred out, time-limited or reduced. Tested up to WordPress 7.1.

= 1.6.1 =
* Fixed: cleared every WordPress.org Plugin Check violation — six request values read without sanitising, a discouraged text-domain call, and a set of table-name and nonce false positives now carry the justification the checker needs. Zero violations.
* Fixed: a CAPTCHA refusal raised by another plugin was counted as a failed password. A visitor turned away by a bot check a few times was then locked out here as well — two plugins compounding one problem. Any error whose code mentions a CAPTCHA is now ignored when counting failed attempts, whichever plugin raised it. Wrong passwords still count exactly as before.

= 1.6.0 =
* New: the whole admin screen has been rebuilt in the DadsFam house style — one calm, tabbed screen (Dashboard · Activity · Settings) that leads with what is true right now and what to do about it, in plain English. Protection status at a glance, a “finish locking things down” checklist that disappears once you're done, big tap-tiles, and an “if something goes wrong” panel with the fix written right there.
* New: “Never lock me out” — one click puts your own address on the allow list, from the dashboard or the checklist.
* New: instant lockout for bot usernames. Anyone trying “admin”, “root”, “test” and friends when no such account exists is a bot; they're locked out on the first try instead of the fifth. Real accounts with those names are never affected. The list is editable.
* New: protection levels. Pick Relaxed, Balanced (recommended) or Strict instead of juggling five numbers — the numbers are still there for people who want them.
* New: Cloudflare and proxy support. Behind Cloudflare, every visitor used to look like the same address, so one bot could lock out your whole site. Choose “Cloudflare” or “Another proxy” under Settings → Where visitors' addresses come from; forwarded headers are only ever trusted when the request genuinely came from the proxy, so nobody can fake their address. The dashboard warns you if it spots Cloudflare and the setting is still on “plain hosting”.
* New: a recovery valve for the free plugin. Add `define( 'DFLS_DISABLE_LOCKOUTS', true );` to wp-config.php and every lockout is switched off until you remove it. The dashboard shows a red warning while it is in place.
* New: “Let everyone back in” clears every active lockout at once; “Block for good” on any row moves an address to the deny list.
* New: the activity log shows “Chrome on Windows” instead of a 200-character user agent, filters with pills, and lets you block an attacker straight from the row.
* Improved: locked-out addresses hammering a real account no longer cost a password-hash check per attempt — the lockout is now applied before the (deliberately slow) password comparison.
* Improved: dashboard statistics come from one query instead of five, and are memoised per request.
* Improved: the live dashboard pauses when the tab is hidden and refreshes the moment you come back.
* Changed: minimum WordPress version is now 6.0. Tested up to 7.0.

= 1.5.5 =
* Fixed: the honeypot bot trap could block genuine sign-ins when a password manager (1Password, LastPass, Bitwarden, browser autofill) filled the hidden field on the visitor's behalf. The trap now ignores values that simply mirror what the visitor legitimately typed, so real people get in and bots still get caught.
* Improved: the honeypot field now carries the ignore hints password managers actually respect, so most of them skip it entirely.

= 1.5.4 =
* New: a clear warning on the plugin’s admin pages when a known conflicting login/2FA plugin (e.g. Loginizer) is active at the same time — running two can break sign-in.
* Improved: translation-ready — the plugin now loads its text domain from a /languages folder.

= 1.5.3 =
* Performance: added a composite database index (status + time) so the dashboard statistics and charts stay fast even with very large activity logs. The index is added automatically on update.

= 1.5.2 =
* Improved: the Activity Log now labels email-link (magic-link) sign-ins from the Pro add-on.
* Hardened: the new-sign-in email alert is wrapped so it can never interfere with logging in.

= 1.5.1 =
* Improved: the Activity Log now labels passkey events (passkey added, removed, sign-in) written by the Pro add-on.

= 1.5.0 =
* New: optional new-sign-in email alert — the account owner is emailed when their account is signed into from an IP not seen before (opt-in under Settings → Notifications; the first login is remembered silently).
* New: export the activity log to CSV from the Activity Log page.
* New: filter the Activity Log by two-factor / security audit events (2FA on/off, device trusted/removed, codes reset).

= 1.4.1 =
* Improved: the Activity Log now shows two-factor audit events (2FA on/off, device trusted/removed, backup codes reset) with their own clear labels.
* Improved: the live dashboard ticker stays focused on genuine login attempts.

= 1.4.0 =
* New: live attack arcs — glowing comet trails streak across the threat sphere from each attacker to a marker representing your site.
* New: ambient pulse rings radiate from the security-score gauge, tinted to your current status.
* New: a soft cursor-follow spotlight glides across each panel for a premium, fluid feel.
* New: unblocking an IP now plays a satisfying “zap” as the row clears.
* Accessibility: all new effects switch off with “reduce motion”.

= 1.3.0 =
* New: rotating 3D wireframe “threat sphere” that plots live attack activity.
* New: hacker-style “decode” animation — stat numbers and the security score scramble, then lock in, on load.
* New: a glowing scan line sweeps across the failed-logins chart.
* New: subtle animated aurora glow behind the whole dashboard (light & dark).
* Accessibility: all of the above switch off automatically with “reduce motion”.

= 1.2.0 =
* New: live “security console” dashboard — an animated Protection Score gauge that reacts to real-time conditions.
* New: live activity ticker and a sweeping attack radar that plots your top attacking IPs.
* New: animated constellation backdrop, 3D-tilt stat cards, and glowing animated panel borders.
* New: one-click Dark Mode (remembered between visits) and an optional alert sound when a new lockout happens.
* Accessibility: every effect is disabled automatically when “reduce motion” is on; sound is off by default.

= 1.1.0 =
* New: live, self-refreshing security dashboard — stats update automatically every 12 seconds with no page reload.
* New: animated 14-day failed-login chart with hover tooltips and smooth transitions.
* New: animated count-up stat cards, and at-a-glance summary cards on the Activity Log page.
* Improved: premium glass UI across the dashboard, log and settings pages.
* Accessibility: all animations honour the “reduce motion” system setting.

= 1.0.0 =
* Initial release: brute-force lockouts, IP allow/deny lists, activity log, dashboard, email alerts, honeypot, generic errors, and hardening (user-enumeration, XML-RPC, pingback).

== Upgrade Notice ==

= 1.7.1 =
Removes our own branding from the emails this plugin sends to your users, and fixes a broken link in the plugin header.

= 1.7.0 =
A settings search and an unsaved-changes save bar. No change to how the protection works — safe drop-in update.

= 1.6.0 =
Brand-new dashboard in the DadsFam house style, Cloudflare/proxy support, instant lockout for bot usernames, protection-level presets and a one-click “never lock me out”. Safe drop-in update — your settings are kept.

= 1.5.4 =
Warns you when a conflicting login/2FA plugin is active, and is now translation-ready. Safe drop-in update.

= 1.5.3 =
Adds a database index so dashboard stats stay fast on large logs (applied automatically). Safe drop-in update.

= 1.5.2 =
Activity Log now labels email-link sign-ins from the Pro add-on. Safe drop-in update.

= 1.5.1 =
Activity Log now labels passkey events from the Pro add-on. Safe drop-in update.

= 1.5.0 =
New-sign-in email alerts, CSV export of the activity log, and an audit-events filter. Safe drop-in update.

= 1.4.1 =
Two-factor audit events now appear clearly in the Activity Log. Safe drop-in update.


= 1.4.0 =
Live attack arcs on the threat sphere, gauge pulse rings, panel spotlight and an unblock animation. Safe drop-in update.

= 1.3.0 =
Adds a rotating 3D threat sphere, decode number animations, a chart scan line and an aurora backdrop. Safe drop-in update.

= 1.2.0 =
A live security-console dashboard with gauge, radar, activity ticker, dark mode and optional alert sound. Safe drop-in update.

= 1.1.0 =
Live auto-refreshing dashboard and a full premium UI refresh. Safe drop-in update.

= 1.0.0 =
First release of DadsFam Login Security.
