Getting Started With AuthDock

You secure a WordPress login with AuthDock by installing the free plugin, enabling the protection layers your site needs — brute-force lockouts, two-factor authentication, social login, magic links, a custom login URL — and letting the audit log record every authentication event from that point on. Nothing is enforced until you turn it on, so activation alone changes nothing.

What AuthDock is

AuthDock is a free, GPL-licensed WordPress login security plugin that replaces the stack of five to seven single-purpose plugins most sites accumulate: a 2FA plugin, a social login plugin, a limit-login plugin, a hide-wp-login plugin, an audit log plugin, and a session manager. All of it runs from one settings screen, one database schema, and one set of capabilities, with no premium tier and no tracking.

The default WordPress login form accepts unlimited attempts, announces valid usernames through author archives, and leaves no record of who tried what. AuthDock closes all three gaps.

A sensible first configuration

Start with the layers that protect without changing how anyone signs in. Enable brute-force protection — five failed attempts triggers a fifteen-minute lockout by default, escalating to one hour and then twenty-four hours on repeat offences. Whitelist your own IP first so you cannot lock yourself out while testing. Block XML-RPC if nothing on your site uses it; it is the quietest channel for credential-stuffing attacks.

Then enable user-enumeration prevention, which blocks author archives, restricts the users endpoint, and returns generic login errors, and switch on the security headers.

Next, decide your login methods. Two-factor authentication is the highest-value single step — enforce it per role so administrators and editors are on a stronger standard than subscribers. Social login (Google, Facebook, GitHub, X) and passwordless magic links can run alongside it; all methods compose through the same verification pipeline, so a social sign-in still passes the 2FA check.

Hardening the login surface

Once the basics work, consider moving the login form to a custom URL so wp-login.php serves a 404 or redirects to the homepage. AuthDock generates a recovery key when you enable this — store it, because it is how you get back in if you forget the new URL. The same applies to wp-admin access control by role or IP range: an emergency bypass key exists so a misconfiguration is never a locked door. Both recovery paths are covered in the lockout recovery guide.

Next steps

• Enable two-factor authentication
• Know your recovery options before you need them