Author website<\/a><\/p>\n\nBuilt by WordPress security specialist Md Jahid Bin Sabit.<\/p>\n\n
Credits<\/h3>\n\n
Defentry is designed, built, and maintained by Md Jahid Bin Sabit<\/strong> \u2014 WordPress security specialist.<\/p>\n\n\n- Website: https:\/\/jbsabit.com\/<\/li>\n
- WordPress.org profile: https:\/\/profiles.wordpress.org\/jbsabit\/<\/li>\n
- Contributor: Reflecters \u2014 https:\/\/profiles.wordpress.org\/wearereflecters\/<\/li>\n<\/ul>\n\n\n
\n- Upload the plugin files to
\/wp-content\/plugins\/defentry\/<\/code>, or install through the WordPress plugins screen.<\/li>\n- Activate the plugin.<\/li>\n
- A notice will prompt an administrator to select the Master Admin<\/strong>. Pick one and save.<\/li>\n
- Open the Defentry<\/strong> menu, set a siren stop password (there is no default \u2014 verification stays off until you set one), and turn Status ON<\/strong>.<\/li>\n
- Done. Logins from new devices will now trigger verification.<\/li>\n<\/ol>\n\n\n
\nWhat happens when someone logs in from a new device?<\/h3><\/dt>\nWhen an administrator, editor, or author logs in from a device Defentry has never seen, the WordPress dashboard is covered by a full-screen overlay asking for the siren stop password \u2014 optionally with a siren sound. Every other logged-in user simultaneously sees a red alert banner (\"New device login detected\") with buttons to trust the device, mute the siren, or take Master Admin action.<\/p><\/dd>\n
How do I trust \/ verify a new device?<\/h3><\/dt>\nEnter the correct siren stop password on the new device and it is trusted permanently. The Master Admin can also trust any device for any user from the alert banner or from Defentry \u2192 Manage Trusted Devices.<\/p><\/dd>\n
Who can block or unblock users?<\/h3><\/dt>\nOnly the Master Admin \u2014 the one administrator designated in the Defentry settings. This keeps emergency response in a single accountable hand.<\/p><\/dd>\n
What exactly does blocking a user do?<\/h3><\/dt>\nThe user is added to the blocklist. On their next dashboard visit they are logged out immediately with a notice, and they cannot use wp-admin again until the Master Admin unblocks them from Defentry \u2192 Manage Blocked Users.<\/p><\/dd>\n
I don't hear the siren. Why?<\/h3><\/dt>\nBrowsers block audio until you interact with the page (click, scroll, or press a key). The siren starts after your first interaction. You can mute it at any time from the alert banner, or disable\/replace it in the Defentry settings.<\/p><\/dd>\n
Can I change the siren sound or turn it off?<\/h3><\/dt>\nYes. In the Defentry settings you can enable or disable the siren and upload your own MP3. Leave the upload empty to use the built-in siren.<\/p><\/dd>\n
Which user roles are protected?<\/h3><\/dt>\nAdministrators, editors, and authors. Contributors, subscribers, and customers are never interrupted.<\/p><\/dd>\n
I forgot the stop password. How do I get back in?<\/h3><\/dt>\nAn administrator with database access can delete the scbr_settings<\/code> row from the wp_options<\/code> table \u2014 the plugin then resets with protection OFF and no stop password set, so you can set a new password. Alternatively, temporarily rename the plugin folder via FTP\/cPanel to disable it, then set a new stop password in the settings.<\/p><\/dd>\nCan an attacker bypass verification by clearing cookies?<\/h3><\/dt>\nNo \u2014 clearing the cookie generates a brand-new random device ID, which is untrusted by definition, so the overlay appears again. The system fails closed.<\/p><\/dd>\n
Does Defentry replace two-factor authentication (2FA)?<\/h3><\/dt>\nNo. Device verification and 2FA stop different attacks \u2014 a stolen password alone is useless against Defentry, and a stolen device alone is useless against 2FA. Use both.<\/p><\/dd>\n
Will Defentry slow down my website?<\/h3><\/dt>\nNo. Its scripts and styles load only on wp-admin pages, and only when needed. Visitors to your public site are completely unaffected, and the plugin makes no external HTTP requests.<\/p><\/dd>\n
Does it work with caching plugins or Cloudflare?<\/h3><\/dt>\nYes. Verification happens inside wp-admin, which caching plugins and CDNs don't cache. One honest note: IP-based attempt limiting reads REMOTE_ADDR<\/code>; behind a reverse proxy or CDN (like Cloudflare) all visitors may share the proxy's IP, so an IP block applies proxy-wide. Device verification itself is unaffected.<\/p><\/dd>\nIs Defentry compatible with multisite?<\/h3><\/dt>\nSettings are stored per site, not network-wide, and multisite has not been officially tested. It should work per-site; network-wide management isn't included.<\/p><\/dd>\n
What data does Defentry store? Is it private?<\/h3><\/dt>\nRandom device IDs (in a browser cookie and per-user metadata), device details (name, trust\/expiry dates, last seen), plugin settings (in wp_options<\/code>), per-IP login attempt counts (kept for 30 days, on your server only), and short-lived transients for login attempts and alerts. Nothing ever leaves your server \u2014 no tracking, no telemetry, no third-party calls.<\/p><\/dd>\nDoes it work with custom login pages, social login, or page builders?<\/h3><\/dt>\nYes. Verification happens inside wp-admin after<\/em> login, so it works regardless of how the user logged in.<\/p><\/dd>\nWhat happens if the Master Admin account is deleted?<\/h3><\/dt>\nDefentry detects the missing Master Admin and prompts an administrator to choose a new one. Protection settings are preserved.<\/p><\/dd>\n
How do I limit login attempts in WordPress?<\/h3><\/dt>\nUse Defentry's built-in login limiter: failed wp-login attempts are counted per IP address, and after the limit you set (default: 5 failures within 15 minutes) that IP is locked out for 30 minutes \u2014 even the correct password is rejected until the lockout expires. You can whitelist your own IP, enable escalating lockouts for repeat offenders, get an email on every lockout, and unlock any IP instantly from Defentry \u2192 Protection. No separate limit-login-attempts plugin needed.<\/p><\/dd>\n
How do I stop brute-force attacks on wp-login.php?<\/h3><\/dt>\nBrute-force bots guess passwords until something works. Defentry stops them at three points: the login limiter locks out guessing IPs (including XML-RPC and REST authentication attempts), per-IP login activity shows you exactly which IPs are attacking and which usernames they are trying, and \u2014 if a password ever does leak \u2014 device verification still blocks the attacker, because a correct password on an unrecognized device only reaches the stop-password verification page.<\/p><\/dd>\n
What happens when an IP is locked out of wp-login?<\/h3><\/dt>\nAfter too many failed login attempts (default: 5 within 15 minutes), that IP is locked out for 30 minutes \u2014 during the lockout even a correct password is rejected with a generic message. If escalating lockouts are enabled, repeat lockouts within 24 hours double in length (up to 24 hours). Whitelisted IPs are never locked out, a successful login clears the failure counter, and the Master Admin can unlock any IP instantly from Defentry \u2192 Protection.<\/p><\/dd>\n
I locked myself out. What now?<\/h3><\/dt>\nWait for the lockout to expire, log in from a different network\/IP, or \u2014 if you have database access \u2014 delete the scbr_lockouts<\/code> row from wp_options<\/code>. To prevent this, whitelist your own IP in Defentry \u2192 Protection \u2192 Login Protection before you need it.<\/p><\/dd>\nDo trusted devices expire?<\/h3><\/dt>\nOnly if you want them to. In Defentry \u2192 Verification you can set newly trusted devices to expire after 30, 90, or 180 days (default: never). Devices trusted before you change the setting never expire unless renewed. An expired device simply verifies with the stop password again, exactly like a new device.<\/p><\/dd>\n
What does the per-IP login activity show?<\/h3><\/dt>\nFor each IP address: total login requests, how many failed, how many succeeded, which usernames were tried, and when it was last seen \u2014 aggregated over the last 7 days in the Protection tab and stored for 30 days. The Master Admin can block an IP for 1 hour, unlock a lockout, or whitelist an IP directly from that table.<\/p><\/dd>\n
How can I see who is trying to log in to my WordPress site?<\/h3><\/dt>\nOpen Defentry \u2192 Protection \u2192 Login Activity by IP. For every IP address you see how many login requests it made in the last 7 days, how many failed, how many succeeded, exactly which usernames it tried, and when it was last seen \u2014 so a brute-force attack, a password-spraying bot, or a colleague who keeps mistyping their password is visible at a glance, and you can block, unlock, or whitelist the IP in one click.<\/p><\/dd>\n
Is Defentry really free?<\/h3><\/dt>\nYes \u2014 100% free, GPL-licensed, no premium version, no upsells, no locked features.<\/p><\/dd>\n\n<\/dl>\n\n\n
2.1.0<\/h4>\n\n\n- SECURITY: Device verification is now enforced server-side. An unverified device receives only a standalone verification page \u2014 no wp-admin screens, AJAX actions, or form handlers run until the stop password is verified (previously the overlay was visual only).<\/li>\n
- SECURITY: The alert banner's \"Trust Device\" button can no longer bypass verification \u2014 trusting your own unverified device now requires the stop password (the Master Admin is exempt).<\/li>\n
- SECURITY: Blocked IPs are now hard-gated on every admin page instead of being skipped by detection, and blocked-user enforcement no longer depends on the overlay feature toggle.<\/li>\n
- SECURITY: XML-RPC and REST authentication failures now count toward login lockouts; the stop password minimum length (6) is enforced server-side on every settings path; Master Admin transfers are validated on every path.<\/li>\n
- NEW: Quick setup popup \u2014 the moment the plugin is activated, administrators get a one-screen setup: choose the Master Admin, set the stop password, turn protection on, and optionally whitelist their own IP so they can never lock themselves out.<\/li>\n
- NEW: Login attempt limiting \u2014 failed wp-login attempts are counted per IP; repeat offenders are locked out (even the correct password is rejected) with configurable thresholds, optional escalating lockouts, an IP whitelist, active-lockout management, and an optional Master Admin email on lockout.<\/li>\n
- NEW: Login activity by IP \u2014 every login attempt (success or failure) is counted per IP for 30 days. The Protection tab shows requests\/failed\/success per IP, usernames tried, and last seen, with one-click Block 1h, Unlock, and Whitelist actions.<\/li>\n
- NEW: Trusted device expiry + naming \u2014 devices are auto-named from the browser\/OS, can be renamed, show trust\/expiry\/last-seen in the Devices tab, and can optionally expire after 30\/90\/180 days (existing devices are grandfathered and never expire unless renewed).<\/li>\n
- NEW: Blocked IPs panel \u2014 IPs auto-blocked after 3 wrong stop-password attempts (and IPs blocked from the alert banner or Login Activity table) are now listed in Defentry \u2192 Protection with the block expiry and a one-click Unblock.<\/li>\n
- SECURITY: no default stop password anymore \u2014 fresh installs start with no password set (verification stays dormant until you set one), installs still using the old public default
2210<\/code> have it removed automatically with an email to the site admin, and protection cannot be switched on before a stop password exists.<\/li>\n- FIX: a trusted device is no longer locked out by an IP block \u2014 the Master Admin can always reach the Defentry settings (and its Unblock button) from a verified device, even on a blocked IP.<\/li>\n
- Code quality: Plugin Check clean \u2014 the gate page escapes its message at output, and the gate's routing-only AJAX action read carries a documented
phpcs:ignore<\/code> justification (no state changes there; every allowed handler verifies its nonce).<\/li>\n<\/ul>\n\n2.0.5<\/h4>\n\n\n- Code quality: documented
phpcs:ignore<\/code> justifications for the five WordPress.Security.NonceVerification.Recommended<\/code> warnings \u2014 all are false positives (display-only $_GET<\/code> reads; every state-changing handler verifies its nonce). No behavior change.<\/li>\n<\/ul>\n\n2.0.4<\/h4>\n\n\n- Redesigned Verification, Devices, Protection, and Master Admin tabs to match the Overview tab: feature toggles instead of checkboxes, device cards per admin, danger-zone reset, blocked-user rows, IP-limit stat tiles, and a Master Admin highlight card.<\/li>\n
- FIXED: saving from the Verification or Master Admin tab silently turned protection OFF (status is now only updated by forms that manage it).<\/li>\n
- Master-Admin-exclusive control plane: secondary admins no longer see the Defentry menu or dashboard widget once setup is complete. Device verification, alert banners, and the siren still protect every admin account.<\/li>\n
- The verification overlay dialog now has its own siren sound toggle, reachable even while the overlay covers the admin notices.<\/li>\n<\/ul>\n\n
2.0.3<\/h4>\n\n\n- FIXED: broadcast siren could stay silent on other admins' browsers \u2014 the realtime poller now retries audio playback on user interaction (browser autoplay policy), and the \"Mute Siren\" button is now a toggle: muted users see \"Unmute Siren\" to re-enable the alert sound.<\/li>\n<\/ul>\n\n
2.0.2<\/h4>\n\n\n- FIXED: settings page showed the old unstyled UI when protection was OFF (v2 stylesheet now loads on the settings page and dashboard regardless of status).<\/li>\n
- NEW: realtime broadcast poller \u2014 other logged-in admins now see and hear the new-device alert within ~25 seconds without reloading the page; the banner auto-clears when the alert ends.<\/li>\n
- Warning banner now blinks with a red alarm glow to catch the eye.<\/li>\n
- NEW: \"Block IP\" button on the alert banner (Master Admin) instantly blocks the new device's IP for 1 hour; \"Block User\" now also instantly blocks the alert IP.<\/li>\n
- Banner action buttons (trust\/block\/mute) now work on every admin page, not just the settings page.<\/li>\n<\/ul>\n\n
2.0.1<\/h4>\n\n\n- Red alarm blink animation on the verification overlay backdrop (respects prefers-reduced-motion).<\/li>\n<\/ul>\n\n
2.0<\/h4>\n\n\n- Complete UI\/UX overhaul: tabbed Master Control Panel (Overview, Verification, Devices, Protection, Master Admin) with a status card, protection toggle, and live stat tiles; 3-step first-run setup wizard; redesigned new-device verification overlay (modern card, shield emblem, smooth entrance animation, fully responsive, reduced-motion aware); new \"Defentry Security\" dashboard widget; polished real-time alert banner. No security-logic changes \u2014 all protection behavior is identical to 1.2.x.<\/li>\n<\/ul>\n\n
1.2.3<\/h4>\n\n\n- Directory assets finalized: real screenshots from a live site, animated siren icon and cinematic banner.<\/li>\n
- Expanded SEO readme: full FAQ (17 questions), credits, and links.<\/li>\n<\/ul>\n\n
1.2.2<\/h4>\n\n\n- SEO readme rewrite with real directory screenshots, keyword-rich description and honest feature list.<\/li>\n<\/ul>\n\n
1.2.1<\/h4>\n\n\n- Plugin Check clean: silenced direct-DB-query warnings in uninstall.php (caching is meaningless during uninstall) and shortened the readme short description to 150 characters.<\/li>\n<\/ul>\n\n
1.2<\/h4>\n\n\n- Security:<\/strong> stop password is now hashed with wp_hash_password() and verified server-side only \u2014 the hash is never printed to the page and the client-token bypass is removed. Plaintext passwords are never stored or displayed.<\/li>\n
- Security:<\/strong> only the device owner or the Master Admin can trust a device for another user.<\/li>\n
- Security:<\/strong> IP detection now uses REMOTE_ADDR only (X-Forwarded-For \/ Client-IP are client-spoofable).<\/li>\n
- New-device email\/broadcast alerts are sent once per device instead of on every page load.<\/li>\n
- Admin menu renamed from \"Siren Protector\" to \"Defentry\"; security headers are now actually sent (previously dead code).<\/li>\n
- Accessibility: alert banner no longer hard-blinks; animation respects prefers-reduced-motion.<\/li>\n
- Added uninstall.php \u2014 all options, transients and user meta are removed on uninstall.<\/li>\n
- Readme rewritten to describe only features the plugin actually has.<\/li>\n<\/ul>\n\n
1.1<\/h4>\n\n\n- Changed prefix from
wrs<\/code> to scbr<\/code> for all options, transients, user meta, cookies, and scripts to avoid conflicts with other plugins.<\/li>\n- Improved script and style enqueuing to load only on relevant admin pages.<\/li>\n
- Added data migration during activation to preserve existing settings and user data.<\/li>\n<\/ul>\n\n
1.0<\/h4>\n\n\n- Initial release with device-based authentication, siren alerts, master admin control, and IP blocking.<\/li>\n<\/ul>","raw_excerpt":"WordPress login security: limit login attempts, lock out brute-force IPs, and verify new devices with a stop password, trusted devices & alerts.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/300582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=300582"}],"author":[{"embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/jbsabit"}],"wp:attachment":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=300582"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=300582"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=300582"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=300582"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=300582"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=300582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}