Protect the login
Login Protect hides the login page and stops anyone guessing passwords. Pro adds lists of trusted and blocked addresses, email alerts and an overview.
In WordPress the plugin is called Datoden Login Protect – in the DT-addons menu it is listed as DT-login-protect.
DT-login-protect protects your login in two ways: the login gets its own address that robots cannot find, and addresses that guess the wrong password too many times are locked out for a while. Everything is set on one page under DT-addons → DT-login-protect, with the tabs Hidden login and Limit attempts.
On the Hidden login tab you type your own address in the Login address field. It is checked as you type, so it is not too short, used by WordPress or already taken by a page. Copy and Email it to me let you keep the address safe right away.
Visitors who are not logged in and try wp-login.php, wp-register.php or wp-admin never see the login. Under Someone tries wp-login.php or wp-admin you choose what they get instead: The page does not exist (404), The front page or A page I choose. Log out, lost password and the password emails pick up the new address by themselves.
On the Limit attempts tab, the Rules section sets how many wrong attempts are allowed and how long an address is locked out. By default it is 20 minutes after 4 wrong attempts, and 24 hours after 4 lockouts. The login page, the shop, XML-RPC and the REST API are all counted, and a locked-out address does not even get its password checked.
With Do not reveal usernames the login only says that the username or password is incorrect, not which one. Show attempts left tells the user how many tries remain, and Turn off XML-RPC closes an old login route that robots like to use.
One click takes over the login address from WPS Hide Login, so your bookmark keeps working. From Limit Login Attempts Reloaded it takes over the rules and current lockouts. The old plugin is turned off in the same step.
Under Lists you enter Trusted addresses that are never locked out and Blocked addresses that can never log in, including ranges and networks. The Add my address button fills in your own. Under Blocked usernames you list names only robots use, such as admin, and anyone trying them is locked out for a long time straight away.
With Email me when someone keeps trying you get an email when the same address has been locked out several times within 24 hours. You choose after how many lockouts, and which address the email goes to.
The overview shows lockouts in total, in the last 24 hours and right now. You see the latest lockouts with address, username and where the attempt was made, plus the usernames robots try most. Individual addresses can be released with Unlock.
Everything without a Pro label works for free. What is marked Pro is included in the Pro version.
After installing – how to set up Login Protect.
Go to DT-addons → DT-login-protect in the WordPress menu.
On the Hidden login tab, type an address only you know and keep it with Copy or Email it to me. From then on you log in at the new address.
Choose what anyone trying wp-login.php or wp-admin should get. The page does not exist (404) is the safest choice.
Open the Limit attempts tab and review the number of attempts and the lockout times under Rules.
Pro builds on the free version – it stays as the base, with all your settings, and Pro adds the rest.
Everything in the free version, plus:
Choose how many websites and how you want to buy. Prices exclude VAT – VAT is calculated at checkout.
The licence follows your Datoden account – no key to paste.
The purchase is saved on your Datoden account as soon as the payment has gone through.
Get the Pro plugin under My account → My purchases → Licences.
Drop the zip file on Website Guard. Pro is added on top of the free version – everything you have done stays.
Connect the website in Website Guard. The Pro updates then arrive as ordinary WordPress updates.
Add the line define('DT_HIDE_LOGIN_OFF', true); to wp-config.php through your web host's file manager. wp-login.php then works again until you remove the line.
Wait for the lockout to expire, log in from another network such as your phone's, or lift the lockout from another computer.
No. Password-protected pages, forms, the shop and plugins that talk to WordPress in the background keep working.
WordPress' own shortcuts to the login are turned off, since they would otherwise reveal the new address.
That happens when the site sits behind a proxy or Cloudflare. Pick the right source under Read the address from – but only in that case, since a wrong choice lets robots fake their address.
Nothing stops working. A purchase never runs out, and when a subscription ends the plugins keep every function – only the updates from Datoden stop.
The first number in the version. A purchase includes every update in that major version, for example all 1.x versions. A new major version (2.0) comes about once a year with clearly new features and comes at a discount as an upgrade. A subscription always includes it.
Websites connected to your Datoden account with a Pro plugin switched on, in the order they were connected. Disconnect a website in My websites to move the licence to another.
No. The website is connected to your Datoden account with Website Guard, and Datoden knows which updates your licences include.
Yes. Deactivate Pro – the free version keeps running with the same settings. Functions that only exist in Pro stop, but nothing is deleted.
Yes. Pro is an add-on: the free version stays installed and active as the base and is updated from WordPress.org as usual, and Pro adds the Pro features on top. On WordPress.org the free versions are called Datoden …, for example Datoden Login Protect.
Prices exclude VAT. VAT is calculated at checkout from your country. Companies in other EU countries can enter their VAT number.
Your licences, websites and downloads are under My account → My purchases → Licences.
