LOGIN PROTECTION
WordPress Login Protection, Turned On in a Minute
WordPress login protection stops bots from guessing passwords on your login page. xCloud turns it on for a WordPress site with one switch: it limits failed logins, bans repeat offenders at the server firewall, and adds two-factor sign-in and bot checks. It is free on every plan.
- Failed logins limited, then banned at the firewall
- Two-factor sign-in and passkeys
- Free, about a minute to turn on
WHY IT MATTERS
Why Protect the WordPress Login Page?
Bots never stop guessing
Every WordPress site gets password guessing on wp-login.php and XML-RPC.
Guesses cost server power
Each failed login runs PHP and a database query. Thousands add up.
Usernames leak
Author pages and the REST API can reveal the usernames bots try.
WHAT YOU GET
What Does xCloud Login Protection Do?
Limit failed sign-ins
After 5 failures in 15 minutes, sign-in pauses for 15 minutes.
Server firewall bans
Each pause also bans that network on the web ports for 15 minutes.
Two-factor and passkeys
Add a second step or a passkey for your WordPress users.
Bot and puzzle checks
A hidden bot check and a small browser puzzle on the login form.
Hide usernames
Block common usernames like admin and hide the public user list.
Protected forms
Comments, password resets and registration are limited and checked too.
HOW IT WORKS
How Do You Turn On Login Protection in xCloud?
Open Security
Open the WordPress site and go to Security, then Overview & Firewall.
Switch it on
Turn on the switch on the login protection card and confirm with Turn On.
Keep the recovery email
Your WordPress admin address gets a one-time link in case you are ever locked out.
Tune the settings
Change any protection on the card and click Save Settings.
LIMITS AND PLANS
What Does It Need?
WordPress 6.7 or newer
And PHP 8.0 or newer for the site. Other site types do not have the card.
Network-wide bans
A ban covers the whole network for 15 minutes, so others in the same office can be locked out too.
Cloudflare aware
Bans the real visitor behind Cloudflare, never Cloudflare itself.
Free on every plan
The card is marked Free in the dashboard.
Frequently Asked Questions
What people ask about Login Protection on xCloud.
What is WordPress login protection?
Login protection limits how many times someone can try a password on your WordPress login page, and blocks them for a while once they go over. Good protection also adds two-factor sign-in and stops bots before they try.
How many failed logins are allowed?
By default, 5 failed logins within 15 minutes pause sign-in for that connection for 15 minutes. You can change the numbers in WP Admin.
What happens at the server firewall?
Each pause also bans the visitor's network, an IPv4 /24 or IPv6 /64, on the HTTP and HTTPS ports for 15 minutes. SSH and other services are not affected.
What if I lock myself out?
When login protection turns on, your WordPress admin email gets a one-time recovery link. You can also open WP Admin from xCloud with Magic Login.
Is login protection free?
Yes. It is free on every xCloud plan, for WordPress sites running WordPress 6.7 or newer and PHP 8.0 or newer.
Stop Password Guessing on Your WordPress Sites
Turn on login protection per site, free, in about a minute.