Introduction to the Login Guard module

Shield Security plugin offers extremely effective protection against WordPress login attacks, and provides tried and tested methods for verifying the identity of users active on the system. 

It is composed of several parts (modules). The Login Guard is one of its modules. 

This module is accessible from within the main navigation menu > Config > Login Protection:

The Login Guard module is quite large and is comprised of several components (features).

Login Guard features explanations

Login Guard features are designed to protect the WordPress login and authentication system against brute force login attacks. They also provide a user identification system in the form of two-factor authentication.

Brute Force Login Protection

Designed for login protection. It blocks brute force hacking attacks against your login and registration pages. 

The options available are as follows: 

  • Antibot Detection Engine

    You can use AntiBot Detection Engine to detect Bots.

    AntiBot Detection Engine is ShieldPRO's exclusive bot-detection technology that removes the needs for CAPTCHA and other challenges.
    This feature is designed to replace the CAPTCHA and Bot Protection options.

    Important - Switching on this feature will disable the CAPTCHA and Bot Protection settings.

  • Protection Locations
    You can choose the forms for which bot protection measures will be deployed
    • login form
    • registration form
    • lost password form
    • Checkout-WooCommerce).
      Use with 3rd party systems such as WooCommerce, requires a Pro license.

  • Login Cooldown Period

    Limits login attempts to every X seconds. WordPress will process only 1 account access attempt per number of seconds specified.
  • 3rd-Party Support

    This option helps you to add support for 3rd-party login, register, and password reset forms such as Woocommerce, BuddyPress and Easy Digital Downloads. The 3rd-Party Support feature is enabled by default on Pro sites.

    The full list of the integrated 3rd-party forms can be found under the Integrations module.

Two-Factor Authentication

The options available for this are as follows:

  • 2FA Verification Page - Choose the type of page provided to users for MFA verification.
  • 2FA Config For Users - Specify pages available to users to configure 2FA on their account.
  • Two-Factor By-Pass
    • A user can by-pass Two-Factor Authentication (2FA) for the set number of days.
    Important: Two-Factor By-Pass option is available with ShieldPRO only.
  • Allow Backup Codes

    Allow users to generate a backup code that can be used to login if 2FA factors are unavailable.

Email Two-Factor Authentication

The options available for this are as follows:

  • Enable Email Authentication

When enabled, this option will require all users to verify their login by email-based two-factor authentication. Learn more about Two-Factor Authentication by Email here.

One-Time Passwords (Google Authenticator 2FA)

Allows users to use Google Authenticator. Learn more about Google Authenticator here.

Hardware 2-Factor Authentication

Allows users to register U2F devices to complete their login.

Currently only U2F keys are supported. Learn more about Hardware 2-Factor Authentication here.

Yubikey Two-factor Authentication

Verifies the identity of the users who log in to your site - i.e. they are who they say they are. Learn more about Yubikey 

Its options are:

  • Enable Yubikey Authentication

When combined with your Yubikey API Key details (below) it will form the basis of your Yubikey Authentication.

  • Yubikey App ID

When combined with your Yubikey API Key (option 3) it will form the basis of your Yubikey Authentication.

  • Yubikey API Key

When combined with your Yubikey App ID (option 2) it will form the basis of your Yubikey Authentication. 

Important: Review the info link on how to get your own Yubikey App ID and API Key.

Read more about Yubikey Authentication here.

Hide Login Page

Hides your wp-login.php page from brute force attacks and hacking attempts - if your login page cannot be found, no-one can login. 

Read more about Hide WP Login Page and how to use this feature.

You can also automatically redirect requests to your new created location for the hidden pages by using " WP Login & Admin Redirect" option.

Depreciated Options

Under this section you can find Login Guard depreciated options.

#1 Bot (GASP) Protection

Protects WP login from automated login attempts by bots. It adds a dynamically (Javascript) generated checkbox to the login form.

#2 CAPTCHA

Adds Google reCAPTCHA or hCAPTCHA to the login screen. You can: use CAPTCHA on the user account forms such as login, register, etc.

Note: You'll need to setup your CAPTCHA API Keys in 'General' settings first.

Use of any theme other than "Light Theme", requires a Pro license.

#3 Antibot Forms

Provide DOM selectors to attach AntiBot protection to any form.

#4 User Messages

This feature helps you to customize the messages displayed to the user. Find out what custom user messages are available here.

The options are:

  • GASP Checkbox Text

You can change the text displayed to the user beside the checkbox.

  • GASP Alert Text

You can change the text displayed to the user in the alert message if they don't check the box.

These options are available with ShieldPRO only.

To find out what the extra features for ShieldPRO are, please follow this link here.

To learn more how Login Guard module works, and what options you should enable, read our blog article here.

We also recommend you to read: