Why We Built It
Because the Login Form Is
Where Sites Actually Fall
Almost every WordPress compromise that is not a vulnerable plugin is a guessed, reused, or phished password. The default login form will accept attempts forever, author archives quietly confirm which usernames are real, and when something does go wrong there is no record of it — nothing to tell you which account was used, from which address, or how many times someone tried before they succeeded.
The fix has always existed, but it arrived as a shopping list. One plugin for two-factor codes, another for social sign-in, another to count failed attempts, another to move wp-login.php, another to keep a log. Each one owns part of the authentication flow, none of them know about the others, and the site owner is left reconciling six settings screens and hoping the interactions are benign.
AuthDock is that shopping list rewritten as one plugin. Social login, magic links, and two-factor authentication compose through the same verification pipeline; lockouts, access control, and sessions share the same role model; and every one of those events lands in the same searchable audit log. It is free, GPL licensed, and built entirely on interfaces WordPress already provides.
One Stack, Not Six
Replaces the usual pile of single-purpose security plugins.
Defence in Depth
Rate limiting, second factors, and access control reinforce each other.
Nothing Hidden
No tracking, no encoded code, and third-party services disclosed up front.
Answers After the Fact
A searchable, exportable record of every authentication event.
Built to Stay Fast
Conditional assets, indexed tables, and non-blocking background jobs.
No Locked Doors
Recovery keys and an emergency bypass for when hardening goes too far.