Title: AuthDock β€” Login Security, 2FA, Social Login & Brute Force Protection Author: RAKIBUZZAMAN Published: June 9, 2026 Last modified: June 9, 2026 --- Search plugins ![](https://ps.w.org/authdock/assets/banner-772x250.png?rev=3566239) ![](https://ps.w.org/authdock/assets/icon-256x256.png?rev=3566239) # AuthDock β€” Login Security, 2FA, Social Login & Brute Force Protection By [RAKIBUZZAMAN](https://profiles.wordpress.org/rakibantor/) [Download](https://downloads.wordpress.org/plugin/authdock.1.0.0.zip) * [Details](https://wordpress.org/plugins/authdock/#description) * [Reviews](https://wordpress.org/plugins/authdock/#reviews) * [Installation](https://wordpress.org/plugins/authdock/#installation) * [Development](https://wordpress.org/plugins/authdock/#developers) [Support](https://wordpress.org/support/plugin/authdock/) ## Description **AuthDock** is a professional-grade WordPress authentication and user access management plugin that replaces 5–7 separate security plugins with a single, unified solution. Built with WordPress-native UI, REST API integration, and zero bloat. Whether you run a membership site, WooCommerce store, multi-author blog, or corporate intranet β€” AuthDock gives you full control over how users log in, stay safe, and interact with your site. #### πŸ”‘ Social Login Let users sign in with one click using their existing accounts. No more forgotten passwords. * **Google OAuth 2.0** β€” Sign in with Google using OAuth 2.0 authorization * **Facebook Login** β€” Authenticate via the Facebook Graph API * **GitHub OAuth** β€” Developer-friendly sign in with GitHub * **X (Twitter) OAuth 2.0** β€” Uses OAuth 2.0 with PKCE (S256) for maximum security * **Button Style** β€” Choose between icon + text, icon only, or text only button styles * **Button Layout** β€” Display buttons vertically or horizontally * **Button Order** β€” Drag and drop to reorder provider buttons * **Default Role** β€” Assign a specific WordPress role to new social registrations( e.g., Subscriber, Customer) * **Auto-Registration** β€” Automatically create WordPress accounts from social profiles * **Domain Restriction** β€” Restrict social login to specific email domains (e.g.,` company.com`, `university.edu`) * **Avatar Integration** β€” Automatically set user profile pictures from social account avatars * **Account Linking** β€” Users can link/unlink social accounts from their WordPress profile page * **Shortcode** β€” Place social login buttons anywhere using `[authdock_social_login]` * **Developer Filters** β€” `authdock_allow_social_account_linking` and `authdock_allow_social_registration` for custom control #### βœ‰οΈ Magic Link Login Passwordless authentication β€” users receive a one-time login link via email. No passwords to remember or leak. * **Enable/Disable** β€” Master toggle for passwordless login * **Link Expiry** β€” Set how long each magic link stays valid (in minutes, default: 10 minutes) * **Rate Limiting** β€” Maximum magic link requests per email per hour (default: 5/hour) to prevent abuse * **Allowed Roles** β€” Restrict magic login to specific user roles (e.g., Subscribers, Editors) * **Force Magic Login Mode** β€” Hide the standard WordPress password form entirely and show only the magic link form * **Custom Email Subject** β€” Personalize the magic link email subject line * **Custom Email Body** β€” Customize the email body using merge tags: `{user_name}`,`{ magic_link}`, `{expiry_time}`, `{site_name}`, `{ip_address}` * **One-Time Use** β€” Each magic link is cryptographically random and can only be used once * **Token Invalidation** β€” Magic links are automatically invalidated when a user changes their password * **Anti-Enumeration** β€” Generic success messages prevent attackers from discovering valid email addresses * **Shortcode** β€” Display the form anywhere with `[authdock_magic_login]` and optional` redirect` attribute #### πŸ” Two-Factor Authentication (2FA) Add a second layer of security to every login. Supports TOTP authenticator apps and email-based verification codes. * **Enable/Disable** β€” Master toggle for two-factor authentication * **TOTP Method** β€” Time-based One-Time Passwords (RFC 6238) with QR code provisioning via Google Authenticator, Authy, Microsoft Authenticator, etc. * **Email Method** β€” Receive a 6-digit numeric verification code via email * **Enforced Roles** β€” Force specific WordPress roles (e.g., Administrator, Editor) to enable 2FA * **Grace Period** β€” Give users a configurable number of days to set up 2FA before enforcement kicks in (default: 3 days) * **Trusted Devices** β€” Allow users to skip 2FA on recognized devices for a configurable number of days (default: 30 days) * **Trust Duration** β€” Set how long a device stays trusted (in days) * **Backup Recovery Codes** β€” Generate 10 one-time-use backup codes for account recovery if the authenticator device is lost * **Brute-Force Protection** β€” Rate-limited to 5 verification attempts per session to prevent code guessing * **Encrypted Secret Storage** β€” TOTP secrets are encrypted with AES-256-CBC before storing in the database * **Replay Protection** β€” Each TOTP code can only be used once per time window ( RFC 6238 Β§5.2) * **Clock Drift Tolerance** β€” Accepts codes from Β±1 time step (30 seconds) to handle minor clock differences * **Interstitial Challenge Screen** β€” Clean, WordPress-native verification screen shown after primary authentication * **Admin Management** β€” Administrators can view and disable 2FA for any user from the user profile page #### πŸ›‘οΈ Brute Force Protection (Login Limiter) Stop brute-force attacks with intelligent lockout rules that escalate automatically. * **Enable/Disable** β€” Master toggle for login attempt limiting * **Max Attempts** β€” Set the number of failed login attempts before triggering a lockout (default: 5) * **Lockout Duration** β€” Time for the initial lockout period in minutes (default: 15 minutes) * **Progressive Lockout** β€” Lockouts automatically escalate: 15 minutes 1 hour 24 hours for repeat offenders * **Auto-Blacklist** β€” Permanently ban an IP after a configurable number of lockouts( e.g., after 5 lockouts) * **IP Whitelist** β€” Allow trusted IP addresses to bypass login limits (supports exact match, CIDR ranges like `192.168.1.0/24`, and wildcards like `10.0.0.*`) * **IP Blacklist** β€” Permanently block specific IP addresses, CIDR ranges, or wildcard patterns * **Notify Admin on Lockout** β€” Send email alerts to the site administrator when an IP gets locked out * **Notify Threshold** β€” Configure after how many lockouts the notification triggers( default: 1) * **XML-RPC Integration** β€” Automatically block XML-RPC authentication from locked- out IPs * **Login Page Warnings** β€” Display remaining attempt count and lockout timers directly on the login page * **Log Retention** β€” Configure how long failed login attempt data is retained ( default: 30 days) * **Trusted Proxies** β€” Specify trusted reverse proxy IPs for accurate client IP detection behind load balancers #### πŸ”„ Dynamic Login & Logout Redirects Send users exactly where they need to go β€” based on their role, or if it is their first login. * **Role-Based Login Redirects** β€” Set a custom URL for each WordPress role after login (e.g., Editors `/editorial-dashboard`, Subscribers `/members-area`) * **Role-Based Logout Redirects** β€” Set a custom URL for each WordPress role after logout * **First-Login Redirect** β€” Redirect brand new users to a welcome page, onboarding wizard, or setup screen on their very first login * **Relative & Absolute URLs** β€” Supports both relative paths (`/dashboard`) and full URLs (`https://example.com/welcome`) * **Open Redirect Prevention** β€” All redirects are validated via `wp_safe_redirect()` and `wp_validate_redirect()` to prevent open redirect attacks #### πŸ“‹ Audit Logging Keep a complete, searchable record of every authentication event happening on your site. * **Enable/Disable** β€” Master toggle for audit logging * **Tracked Events** β€” Login success, login failure, logout, password reset, password change, user registration, profile updates (email/role changes), social login, social linking/unlinking, magic link requests, magic link usage, 2FA enabled/ disabled, session termination, access blocked, lockout events * **Event Details** β€” Each log entry records: user ID, event type, IP address, user agent, JSON context data, and precise timestamp * **Retention Period** β€” Choose how long to keep logs: 30, 60, 90, 180, 365 days, or unlimited (0 = forever) * **Auto-Cleanup** β€” Daily WP-Cron job automatically removes expired log entries in batches of 1,000 to avoid database locks * **Filter by Event Type** β€” View only specific event categories (e.g., show only failed logins) * **Filter by Date Range** β€” Narrow results by `date_from` and `date_to` parameters * **Filter by User** β€” View all events for a specific user ID * **Search by IP** β€” Find all events from a particular IP address * **Full-Text Search** β€” Search across event types, IPs, and context data * **CSV Export** β€” Download your complete audit log as a CSV file with formula injection protection * **JSON Export** β€” Export logs in JSON format for integration with external tools * **Purge All Logs** β€” One-click purge to clear all historical log data * **Admin UI Viewer** β€” Built-in admin page with paginated table, filters, and export buttons * **Custom Database Table** β€” Logs are stored in a dedicated `authdock_audit_logs` table with proper indexes for fast queries #### 🏰 Security Hardening Close common WordPress security holes without installing another plugin. **Custom Login URL** * **Custom Slug** β€” Replace `wp-login.php` with your own secret URL (e.g., `/my-secure-login`) * **Block Action** β€” Choose what happens when someone visits the default `wp-login.php`: return a 404 error or redirect to the homepage*** Recovery Key** β€” Access the login page in emergencies via a secret query parameter even when the custom URL is active **XML-RPC Control** * **Disable XML-RPC** β€” Completely disable the XML-RPC interface to block remote brute-force attacks * **Partial Disable** β€” Remove only authentication methods while keeping pingbacks functional **REST API Restriction** * **Restrict to Authenticated Users** β€” Block all REST API access for unauthenticated visitors * **Namespace Whitelist** β€” Allow specific third-party REST namespaces (e.g., WooCommerce, Jetpack) to remain accessible **User Enumeration Prevention** * **Block Author Archives** β€” Redirect `?author =N` enumeration queries to the homepage * **Restrict User REST Endpoint** β€” Block`/ wp-json/wp/v2/users` for non-logged-in users * **Generic Login Errors** β€” Replace specific β€œusername not found” or β€œwrong password” messages with a generic error **Password Strength Enforcement** * **Force Strong Passwords** β€” Master toggle for password policy enforcement * **Minimum Length** β€” Set the minimum password length (default: 8 characters) * **Require Uppercase** β€” Mandate at least one uppercase letter * **Require Lowercase** β€” Mandate at least one lowercase letter * **Require Number** β€” Mandate at least one numeric digit * **Require Special Character** β€” Mandate at least one special character (e.g., `!@#$%`) * **Enforced Roles** β€” Apply password rules only to specific roles **Security HTTP Headers** * **X-Content-Type-Options** β€” Prevents MIME-type sniffing(` nosniff`) * **X-Frame-Options** β€” Blocks clickjacking by restricting iframe embedding(` SAMEORIGIN`) * **X-XSS-Protection** β€” Legacy XSS filter for older browsers (`1; mode=block`) * **Referrer-Policy** β€” Controls referrer information sent with requests(` strict-origin-when-cross-origin`) * **Strict-Transport-Security (HSTS)** β€” Enforces HTTPS connections for 1 year (`max-age=31536000; includeSubDomains`) * **Permissions- Policy** β€” Restricts access to camera, microphone, and geolocation APIs **Role-Based Session Duration** * **Per-Role Cookie Lifetime** β€” Set different authentication cookie durations per WordPress role (in hours) #### πŸ“§ Email Notifications Stay informed about critical security events with real-time email alerts β€” for admins and users. **Admin Notifications** * **Multiple Failed Logins** β€” Alert every N failed attempts from the same IP (default: every 3) * **IP Lockout** β€” Alert when an IP address gets locked out * **Admin Login Alert** β€” Notify when an administrator account logs in * **New User Registration** β€” Alert on every new user registration * **User Promoted to Admin** β€” Alert when any user is promoted to the Administrator role * **Admin Password Changed** β€” Alert when an administrator’s password is changed or reset *** 2FA Disabled** β€” Alert when any user disables their two-factor authentication * ** Login from New IP** β€” Alert when a user logs in from a previously unseen IP address **User Self-Notifications** * **Password Changed** β€” Notify the user when their password is changed * **Email Changed** β€” Notify at the OLD email address when a user’s email is updated (security measure) * **2FA Status Changed** β€” Notify the user when 2FA is enabled or disabled on their account * **Social Account Linked**β€” Notify when a social provider is connected to their account * **New Device Login**β€” Notify the user when a login is detected from a new IP address * **Account Locked**β€” Notify the user when their account is locked due to failed attempts **Notification Settings** * **Custom Recipients** β€” Set custom email addresses for admin notifications (defaults to the site admin email) * **Throttle Period**β€” Configurable cooldown in minutes to prevent notification flooding (default: 60 minutes)*** Digest Mode** β€” Option to batch notifications instead of sending them individually*** Test Email** β€” Send a test notification to verify your email configuration is working #### πŸšͺ wp-admin Access Control Restrict who can access the WordPress dashboard β€” by role, by IP, or both. * **Enable/Disable** β€” Master toggle for access control * **Blocked Roles** β€” Select which WordPress roles are blocked from accessing `/ wp-admin` (e.g., Subscriber, Customer) * **IP Restriction Mode** β€” Enable IP-based restrictions so only whitelisted IPs can access wp-admin * **IP Whitelist** β€” Specify allowed IP addresses and CIDR ranges (e.g., `203.0.113.5`,` 192.168.1.0/24`) * **Hide Admin Bar** β€” Remove the WordPress admin bar from the frontend for blocked roles * **Redirect Action** β€” Choose what happens when access is denied: redirect to homepage, redirect to a custom URL, or show a 403 Forbidden page * **Custom Redirect URL** β€” Set a specific URL for the access-denied redirect * **Emergency Bypass Key** β€” A secret query parameter (`?authdock_bypass=YOUR_KEY`) to regain access if you get locked out * **Smart Exceptions** β€” AJAX requests, WP-Cron, and `admin-post.php` are always allowed through * **Administrator Immunity** β€” Administrators are never blocked, regardless of settings #### ⏱️ Session Management Take control of user sessions β€” limit concurrent logins, enforce idle timeouts, and terminate sessions remotely. * **Enable/Disable** β€” Master toggle for session management * **Concurrent Session Limit** β€” Set the maximum number of simultaneous active sessions per user (0 = unlimited). Oldest sessions are destroyed when the limit is exceeded * **Idle Session Timeout** β€” Automatically log out users after a configurable period of inactivity (in minutes, 0 = disabled) * **Per-Role Session Duration** β€” Set different session lifetimes for each WordPress role (in hours) * **Admin Session Viewer** β€” View all active user sessions via the REST API, including user details and last activity timestamps * **Remote Session Termination** β€” Administrators can terminate all sessions for any user with a single API call * **Throttled Activity Tracking** β€” Last-activity timestamps are updated at most once per 5 minutes to minimize database writes #### ⚑ Performance & Infrastructure AuthDock is built for speed and follows WordPress best practices from top to bottom. * **Conditional Asset Loading** β€” CSS and JavaScript files load only on pages where they are needed * **Indexed Database Tables** β€” Custom tables use proper indexes for fast lookups * **WP-Cron Maintenance** β€” Audit log cleanup runs via non-blocking WP-Cron * **Transient-Based Tracking** β€” Brute force attempt tracking uses transients ( no additional DB queries per login attempt) * **REST API Powered** β€” All admin data operations go through the `authdock/v1` REST API namespace with 15+ endpoints * **Hook-Based Architecture** β€” Centralized Loader class registers all hooks for clean dependency management * **Custom Capabilities** β€” `authdock_manage_settings`, `authdock_view_audit_logs`,` authdock_export_audit_logs`, `authdock_manage_sessions`, `authdock_manage_lockouts` * **Clean Activation** β€” Creates database tables, sets default options, registers capabilities, and schedules cron * **Clean Deactivation** β€” Clears cron events but preserves all settings for reactivation * **Full Uninstall** β€” Removes everything: options, user meta, database tables, capabilities, and transients * **Full i18n** β€” All user-facing strings use proper WordPress internationalization functions with the `authdock` text domain #### πŸ€” Why Choose AuthDock? * **Replace 5–7 plugins** β€” Social login + magic links + 2FA + brute force + audit logs + session management + access control β€” all in one * **WordPress-native UI** β€” Looks and feels like core WordPress, not a foreign dashboard * **REST API powered** β€” Modern, secure data handling for all admin operations * **Lightweight & fast** β€” … ## Screenshots [⌊Dashboard β€” Overview of authentication activity with live stats and quick feature toggles.βŒ‰βŒŠDashboard β€” Overview of authentication activity with live stats and quick feature toggles.βŒ‰[ **Dashboard** β€” Overview of authentication activity with live stats and quick feature toggles. [⌊Social Login Settings β€” Configure Google, Facebook, GitHub, and X OAuth providers with button style options.βŒ‰βŒŠSocial Login Settings β€” Configure Google, Facebook, GitHub, and X OAuth providers with button style options.βŒ‰[ **Social Login Settings** β€” Configure Google, Facebook, GitHub, and X OAuth providers with button style options. [⌊Magic Link Settings β€” Configure link expiry, rate limiting, allowed roles, and force-magic mode.βŒ‰βŒŠMagic Link Settings β€” Configure link expiry, rate limiting, allowed roles, and force-magic mode.βŒ‰[ **Magic Link Settings** β€” Configure link expiry, rate limiting, allowed roles, and force-magic mode. [⌊Two-Factor Authentication β€” TOTP and email-based 2FA setup with QR code provisioning and backup codes.βŒ‰βŒŠTwo-Factor Authentication β€” TOTP and email-based 2FA setup with QR code provisioning and backup codes.βŒ‰[ **Two-Factor Authentication** β€” TOTP and email-based 2FA setup with QR code provisioning and backup codes. [⌊Login Protection β€” Brute force settings with progressive lockout, IP whitelist/ blacklist, and notification options.βŒ‰βŒŠLogin Protection β€” Brute force settings with progressive lockout, IP whitelist/blacklist, and notification options.βŒ‰[ **Login Protection** β€” Brute force settings with progressive lockout, IP whitelist/ blacklist, and notification options. [⌊Dynamic Redirects β€” Role-based login and logout redirect rules with first-login redirect.βŒ‰βŒŠDynamic Redirects β€” Role-based login and logout redirect rules with first- login redirect.βŒ‰[ **Dynamic Redirects** β€” Role-based login and logout redirect rules with first-login redirect. [⌊Audit Logs β€” Searchable, filterable log of all authentication events with CSV/ JSON export.βŒ‰βŒŠAudit Logs β€” Searchable, filterable log of all authentication events with CSV/JSON export.βŒ‰[ **Audit Logs** β€” Searchable, filterable log of all authentication events with CSV/ JSON export. ## Blocks This plugin provides 1 block. * AuthDock Login Form Display a complete login form with social login buttons, magic link, and 2FA support. ## Installation 1. Upload the `authdock` folder to `/wp-content/plugins/` 2. Activate the plugin through the β€˜Plugins’ menu in WordPress 3. Go to **AuthDock** in the admin menu to configure settings 4. Enable the features you want to use Or install directly from the WordPress plugin repository: 1. Go to **Plugins Add New** in your WordPress admin 2. Search for β€œAuthDock” 3. Click **Install Now**, then **Activate** ## FAQ ### Does AuthDock work with WooCommerce? Yes. Social login buttons can be displayed on WooCommerce login and checkout pages when WooCommerce is active. Role-based redirects also work with WooCommerce customer roles. ### Is AuthDock multisite compatible? Yes. Each subsite in a WordPress multisite network has independent settings and its own audit log table. ### Will AuthDock slow down my site? No. AuthDock uses conditional asset loading β€” CSS and JavaScript are only loaded on pages where they are needed. Database queries use proper indexing, and brute force tracking uses lightweight transients instead of database writes. ### What happens when I deactivate the plugin? Cron events are cleaned up, but your settings, database tables, and user data are preserved so you can reactivate later without losing configuration. ### What happens when I delete the plugin? All plugin data is completely removed: options, user meta (social IDs, 2FA secrets, trusted devices), custom database tables, custom capabilities, and transients. ### Can I use social login and 2FA together? Absolutely. When a user logs in via social login, they are still required to complete the 2FA challenge if 2FA is enabled for their account or role. AuthDock ensures 2FA cannot be bypassed regardless of the login method. ### What authenticator apps work with AuthDock 2FA? Any TOTP-compatible authenticator app works, including Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and FreeOTP. ### What if I get locked out by the custom login URL? AuthDock includes a recovery key parameter. Access your login page via `?authdock_recover =YOUR_KEY` to bypass the custom login URL block. The recovery key is set in your security settings. ### Does the brute force protection work with Cloudflare or reverse proxies? Yes. You can configure trusted proxy IPs in the login limiter settings, and AuthDock will correctly read the real client IP from `X-Forwarded-For` headers. ### Can I export my audit logs? Yes. Audit logs can be exported in both CSV and JSON formats via the REST API or the admin UI. CSV exports include formula injection protection for safe spreadsheet use. ## Reviews There are no reviews for this plugin. ## Contributors & Developers β€œAuthDock β€” Login Security, 2FA, Social Login & Brute Force Protection” is open source software. The following people have contributed to this plugin. Contributors * [ RAKIBUZZAMAN ](https://profiles.wordpress.org/rakibantor/) [Translate β€œAuthDock β€” Login Security, 2FA, Social Login & Brute Force Protection” into your language.](https://translate.wordpress.org/projects/wp-plugins/authdock) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/authdock/), check out the [SVN repository](https://plugins.svn.wordpress.org/authdock/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/authdock/) by [RSS](https://plugins.trac.wordpress.org/log/authdock/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release * Social Login with Google, Facebook, GitHub, and X (Twitter) via OAuth 2.0 * Magic Link passwordless login with configurable expiry, rate limiting, and force- magic mode * Two-Factor Authentication β€” TOTP (RFC 6238) and email-based 2FA with encrypted secret storage, backup codes, trusted devices, and per-role enforcement * Brute force protection with configurable attempts, progressive lockout escalation, IP whitelist/blacklist with CIDR and wildcard support, and auto-blacklist * Dynamic login/logout redirects with per-role configuration and first-login redirect * Comprehensive audit logging to custom database table with retention, filters, CSV/JSON export, and auto-cleanup * Security hardening β€” custom login URL with recovery key, XML-RPC control, REST API restriction, user enumeration prevention, password strength enforcement, and 6 security HTTP headers * wp-admin access control with role-based and IP-based restrictions, admin bar hiding, emergency bypass key, and smart AJAX/cron exceptions * Session management β€” concurrent session limiting, idle timeout, per-role session duration, admin session viewer, and remote termination * Email notification system with 8 admin triggers, 6 user self-notification triggers, configurable throttling, custom recipients, and test email * REST API namespace `authdock/v1` with 15+ endpoints for all data operations * 5 custom capabilities for granular permission control * Full i18n support with `.pot` file * WordPress.org compliance β€” GPL-2.0+, no tracking, no encoded code, third-party service disclosure ## Meta * Version **1.0.0** * Last updated **8 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.0** * PHP version ** 7.4 or higher ** * Tags * [access-control](https://wordpress.org/plugins/tags/access-control/)[brute force protection](https://wordpress.org/plugins/tags/brute-force-protection/) [login security](https://wordpress.org/plugins/tags/login-security/)[social login](https://wordpress.org/plugins/tags/social-login/) [two factor authentication](https://wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://wordpress.org/plugins/authdock/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/authdock/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/authdock/reviews/) ## Contributors * [ RAKIBUZZAMAN ](https://profiles.wordpress.org/rakibantor/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/authdock/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://degird.com)