DoLogin Security

In one click, your WordPress login page will be pretected with the smart brute force attack protection! Any login attempts more than 6 in 10 minutes (default value) will be limited.

Limit the number of login attempts through both the login and the auth cookies.

• Two-factor Authentication login.

• KeyLockr SSO scan login with encrypted appdata hash verification and session-bound encryption.

• Cloudflare Turnstile (better than Google reCAPTCHA).

• GeoLocation (Continent/Country/City) or IP range to limit login attempts.

• Passwordless login link.

• Support Whitelist and Blacklist.

• GDPR compliant. With this feature turned on, all logged IPs get obfuscated (md5-hashed).

• WooCommerce Login supported.

• XMLRPC gateway protection.

🛡️ Security, explained simply

🔑 A stolen database should not become a bag of ready-to-use login secrets.

DoLogin separates stored data from the WordPress authentication salts. If an attacker copies only the database—but does not have the salts from the site configuration—the protected values cannot be used as login links, TOTP seeds, or signing keys.

🔗 Passwordless and child-site tokens: compare without storing the secret

Secret in the generated link ➜ `salt-keyed HMAC` ➜ `database stores only the verifier`

• The raw token is shown when it is created and is never saved in the token table.
• Login recomputes the HMAC and compares it in constant time.
• A copied database verifier cannot be pasted into a URL as a working login token.
• One-time tokens are consumed with an atomic database update, so simultaneous replay attempts cannot both win.

🔐 TOTP and signing keys: encrypted when the server must recover them

TOTP seed or private key ➜ `authenticated encryption + site salt` ➜ `ciphertext in the database`

TOTP verification and digital signatures need the original secret at runtime, so these values cannot use a one-way hash. DoLogin encrypts them instead and rejects modified ciphertext. Existing TOTP seeds and Site Easy Login private keys are migrated automatically.

🏠 Site Easy Login: one signed message, one destination, one use

User + trusted public key + destination + issue time + random token ID ➜ `one Ed25519 signature`

The child site verifies the complete signed message with the public key already saved for that connection. Changing the user or destination breaks the signature, and an atomic consume step blocks replay.

📱 KeyLockr SSO: stable signing and encryption identity

Read the full description on the official page →