Skip to main content
WordPress Plugin · by Degird

The Complete WordPress Login Security & 2FA Plugin

Two-factor authentication, social login, passwordless magic links, brute-force lockouts, access control, and audit logging — in one native plugin.

AuthDock replaces the five to seven separate security plugins most WordPress sites stack on top of each other. Everything runs on WordPress-native interfaces and a documented REST API, with no tracking, no obfuscated code, and no premium upsell hiding the feature you actually needed.

Free forever · GPL-2.0+ · WordPress 6.0+ · PHP 7.4+

One Plugin, Not Seven

Every Layer of WordPress Authentication, Unified

Login protection is usually assembled from a 2FA plugin, a social login plugin, a limit-login plugin, a hide-wp-login plugin, an audit log plugin, and a session manager. AuthDock is all of those, sharing one settings screen, one database schema, and one set of capabilities.

TOTP & Email 2FA
Brute-Force Lockouts
Social & Magic Link Login
Complete Audit Trail

Who It's For

Who Uses AuthDock?

If your WordPress site has users other than you — customers, members, authors, or staff — the login form is the part of it attackers actually target.

Membership & Community Sites

Give members social login and passwordless magic links so signing in never depends on a password they have forgotten, while role-specific 2FA enforcement keeps moderators and administrators on a stronger standard than everyone else.

WooCommerce Stores

Social buttons render on the WooCommerce login and checkout forms, and role-based redirects send customers to their account page instead of wp-admin.

Multi-Author Blogs

Require two-factor authentication for editors and administrators, log every publish-adjacent account change, and keep contributors out of the dashboard entirely.

Corporate & Intranet Sites

Restrict registration to approved email domains, lock wp-admin to a whitelisted CIDR range, enforce a password-strength policy per role, and keep an exportable audit trail of every login, logout, and permission change for internal review.

Agencies & Maintainers

Harden every client site with the same configuration, then hand over a dashboard that shows exactly who signed in, from where, and when.

Multisite Networks

Each subsite keeps its own AuthDock settings and its own isolated audit log, so network policy and per-site policy never collide.

Anyone Still Running wp-login.php Wide Open

The default WordPress login form accepts unlimited attempts, announces valid usernames through author archives, and leaves no record of who tried what. AuthDock closes all three gaps in a single activation — lockouts, enumeration prevention, and a logged history you can search, filter, and export.

Core Features

Nine Layers Between Your Site and a Compromised Login

Each feature is independent — enable only what your site needs — but they are designed to compose. Social login, magic links, and two-factor authentication all run through the same verification pipeline.

01 / 09

Two-Factor Authentication

TOTP codes to RFC 6238 with QR provisioning, plus six-digit email codes for users who do not want an app. Enforce 2FA per role with a configurable grace period (three days by default), remember trusted devices for thirty days, and issue ten one-time backup codes for lockout recovery. TOTP secrets are stored under AES-256-CBC encryption, verification is replay-protected with ±1 time-step drift tolerance, and attempts are rate limited to five per session — so a stolen password on its own stops being enough.

Simple Workflow

How AuthDock Works

Four steps from a default wp-login.php to a logged, rate-limited, multi-factor front door.

01

Install & Activate

Install from the WordPress.org plugin directory, activate, and open the AuthDock settings screen. Nothing is enforced until you turn it on.

02

Choose Your Login Methods

Enable social providers, magic links, and two-factor authentication, then decide which roles each one applies to and where users land after signing in.

03

Set Protection Thresholds

Pick your failed-attempt limit and lockout durations, whitelist your own IP, move the login URL, and lock wp-admin down to the roles that need it.

04

Watch the Audit Log

Every login, lockout, and account change is recorded. Filter, search, and export it whenever you need to answer who did what, from where.

Pricing

Free Forever. Every Feature Included.

AuthDock is a free plugin on WordPress.org under the GPL-2.0-or-later licence. There is no pro tier, no feature gate, and no licence key to renew.

Free Forever

Complete
$0

GPL licensed

The whole plugin — 2FA, social login, magic links, brute-force protection, access control, sessions, and audit logging.

Two-factor authentication (TOTP + email)
Google, Facebook, GitHub & X social login
Passwordless magic link login
Brute-force lockouts & IP blacklisting
Custom login URL & wp-admin access control
Full audit log with CSV & JSON export
Per-role sessions, redirects & password policy
Shortcodes, Gutenberg block & REST API

Version 1.0.2. Requires WordPress 6.0 or newer and PHP 7.4 or newer; tested up to WordPress 7.0.2. Social login requires your own OAuth application credentials from each provider, which are free to create.

Full Feature Set

More Built-In Controls

Beyond the nine core layers, AuthDock covers the smaller details that usually require another plugin or a snippet in functions.php.

Dynamic Redirects

Per-role login and logout destinations, plus a separate first-login redirect.

Open-Redirect Prevention

Relative and absolute redirect targets are validated through WordPress before use.

Trusted Proxy Support

Read the real client IP behind Cloudflare or a reverse proxy via X-Forwarded-For.

IP Whitelist

Exempt addresses from lockouts using exact, CIDR, or wildcard matching.

IP Blacklist

Block known-bad addresses outright, manually or after repeated lockouts.

Backup Codes

Ten single-use recovery codes issued when a user enrols in two-factor authentication.

QR Enrolment

Scan to provision any RFC 6238 authenticator app — no manual secret entry.

Trusted Devices

Skip 2FA prompts on recognised devices for a configurable thirty days.

Account Linking

Users connect or disconnect social providers from their own profile screen.

Shortcodes & Block

[authdock_social_login], [authdock_magic_login], [authdock_login_form] and a Gutenberg login block.

REST API

The authdock/v1 namespace exposes 15+ endpoints powering the admin UI.

Custom Capabilities

Five granular capabilities for settings, audit viewing, export, sessions, and lockouts.

Log Export & Purge

CSV with formula-injection safeguards, JSON export, or a full one-click purge.

Retention Policies

Keep logs for 30, 60, 90, 180, or 365 days — or indefinitely.

Conditional Assets

Scripts and styles load only on the screens that need them.

Translation Ready

Fully internationalised, with every user-facing string available for translation.

Built to Replace a Stack

Five to Seven Plugins, Replaced by One

The usual WordPress security setup is an accident of history: a 2FA plugin, a social login plugin, a limit-login plugin, a hide-wp-login plugin, an audit log plugin, and a session manager — six vendors, six update cadences, six settings screens, and six chances for one of them to conflict with the others. AuthDock is a single plugin built on WordPress-native interfaces and a documented REST API, with no tracking, no encoded code, and transparent disclosure of every third-party service it talks to.

What the consolidation actually buys you:

One coherent policy roles, redirects, and enforcement configured once instead of six times
One lightweight footprint conditional assets, indexed custom tables, non-blocking WP-Cron, transient-based tracking
One auditable codebase GPL-2.0+, readable PHP, and a REST namespace you can inspect yourself

Deactivating AuthDock clears its scheduled cron events but leaves your settings, tables, and user data intact. Deleting the plugin removes everything — the choice stays yours.

Why We Built It

Because the Login Form Is
Where Sites Actually Fall

Almost every WordPress compromise that is not a vulnerable plugin is a guessed, reused, or phished password. The default login form will accept attempts forever, author archives quietly confirm which usernames are real, and when something does go wrong there is no record of it — nothing to tell you which account was used, from which address, or how many times someone tried before they succeeded.

The fix has always existed, but it arrived as a shopping list. One plugin for two-factor codes, another for social sign-in, another to count failed attempts, another to move wp-login.php, another to keep a log. Each one owns part of the authentication flow, none of them know about the others, and the site owner is left reconciling six settings screens and hoping the interactions are benign.

AuthDock is that shopping list rewritten as one plugin. Social login, magic links, and two-factor authentication compose through the same verification pipeline; lockouts, access control, and sessions share the same role model; and every one of those events lands in the same searchable audit log. It is free, GPL licensed, and built entirely on interfaces WordPress already provides.

One Stack, Not Six

Replaces the usual pile of single-purpose security plugins.

Defence in Depth

Rate limiting, second factors, and access control reinforce each other.

Nothing Hidden

No tracking, no encoded code, and third-party services disclosed up front.

Answers After the Fact

A searchable, exportable record of every authentication event.

Built to Stay Fast

Conditional assets, indexed tables, and non-blocking background jobs.

No Locked Doors

Recovery keys and an emergency bypass for when hardening goes too far.

FAQ

Frequently Asked Questions

Get Started

Ready to Lock Down Your WordPress Login?

Install AuthDock from the WordPress.org directory, enable the layers your site needs, and start recording every authentication event. It takes a few minutes and costs nothing.

Free forever · GPL-2.0+ · No tracking · No premium upsell