Mask login URL
Every bot knows the URL /wp-login.php. Changing it to something else eliminates 99% of brute-force attempts — not because it's unbreakable, but because the bots don't know where to look.
Via Wigmorean → Login Security → Mask Login:
- Flip Enable mask
- Choose a custom login slug — something not guessable, like
/my-unique-login-a7x/ - Save
Now /wp-login.php returns 404 and only your custom URL works.
Passkeys (WebAuthn)
Passkeys replace passwords with cryptographic keys stored on your device (or in your cloud — iCloud Keychain, 1Password, Google Password Manager). They're phishing-proof and faster than typing a password.
Enable per user:
- User goes to Users → Profile → Passkeys
- Clicks Register Passkey
- Completes the browser's prompt (Face ID, Touch ID, security key)
- Next login, clicks Sign in with passkey — no password needed
Passwords still work unless you disable them. For high-security accounts, force passkey-only via the user role setting.
Failed login lockout
After N failed attempts from a single IP, SafeGuard locks that IP out for M minutes. Default: 5 attempts / 30 minutes. Configure in Login Security → Lockout:
- Attempts before lockout
- Lockout duration
- Exempt IPs (your office, your home)
- Notification email on lockout
Seeing who tried to log in
The Login Log records every attempt — successful or failed — with IP, timestamp, user agent, and outcome. Failed attempts on a valid username are highlighted separately from attempts on nonexistent users (the former are more concerning).
Emergency unlock
If you lock yourself out, SSH into the server and run:
wp wigmorean-login unlock --ip=1.2.3.4Or edit wp-config.php to temporarily disable the plugin.