The Complete WordPress Authentication & Login Security Plugin

Almost every WordPress compromise that is not a vulnerable plugin is a guessed, reused, or phished password. The default login form will accept attempts forever, author archives quietly confirm which usernames are real, and when something does go wrong there is no record of it — nothing to tell you which account was used, from which address, or how many times somebody tried before they succeeded.

The fix has always existed, but it arrived as a shopping list: one plugin for two-factor codes, another for social sign-in, another to count failed attempts, another to move wp-login.php, another to keep a log, and — the moment an organisation with a staff directory turns up — a sixth for SSO that knows about none of the others. Six vendors, six update cadences, six settings screens, and six chances for one to conflict with the rest. AuthDock is that shopping list rewritten as one plugin, where every sign-in method composes through the same verification pipeline and every event lands in the same searchable log.

Version 2.0 added the half an organisation actually buys an authentication plugin for — single sign-on, risk-based rules, six more providers, passwordless-first, analytics, account lifecycle, network policies, configuration as code, log integrity and streaming — then rebuilt the admin around them: twenty-four menu items became seven, setup became a guided stepper, and every screen got a light and a dark theme. One rule ran through all of it, and it is the most distinctive thing about the release: a change AuthDock makes on your behalf may only ever make a site more protected than it was. The setup wizard never writes a false, empties a list, or loosens a policy. A network policy can make fifty sites stricter and has deliberately no way to make them looser. Risk scoring only ever raises the bar. The password is hidden, never removed. The log reports, and never repairs.