Title: Lockspire – Limit Login and Smart Access Protection Author: ghimireanil Published: 6. februara 2026 Last modified: 12. oktobra 2026 --- Tykače pytać Tutón tykač **njeje so z najnowšimi 3 hłownymi wersijemi WordPress testował**. Snano so hižo njewothladuje abo njepodpěruje a ma problemy z kompatibelnosću, hdyž so z nowšimi wersijemi WordPress wužiwa. ![](https://s.w.org/plugins/geopattern-icon/lockspire-smart-access-protection.svg) # Lockspire – Limit Login and Smart Access Protection Wot [ghimireanil](https://profiles.wordpress.org/ghimireanil/) [Sćahnyć](https://downloads.wordpress.org/plugin/lockspire-smart-access-protection.2.0.0.zip) * [Podrobnosće](https://hsb.wordpress.org/plugins/lockspire-smart-access-protection/#description) * [Pohódnoćenja](https://hsb.wordpress.org/plugins/lockspire-smart-access-protection/#reviews) * [Instalacija](https://hsb.wordpress.org/plugins/lockspire-smart-access-protection/#installation) * [Wuwiće](https://hsb.wordpress.org/plugins/lockspire-smart-access-protection/#developers) [Podpěra](https://wordpress.org/support/plugin/lockspire-smart-access-protection/) ## Wopisanje **Lockspire** is a focused, lightweight WordPress login security plugin. It stops brute-force attacks by locking out IPs that exceed your failed-login threshold, alerts you when it happens, and gives you a clear picture of your site’s security without unnecessary complexity. #### What it does **Lockspire does a small number of things well, rather than doing many things poorly.** #### ✅ Smart Login Protection Automatically locks out IP addresses after too many failed login attempts. The lockout expires on its own – no manual intervention needed. The lockout threshold and duration are fully configurable. #### ✅ 🚨 One-Click Emergency Shield / Lockdown Under active attack? Activate Emergency Lockdown with a single click to instantly tighten thresholds (2 attempts max, 60-minute lockdown) and defeat distributed bot attacks. #### ✅ 🍯 Bot Honeypot Auto-Ban Instantly locks out automated bots targeting prohibited usernames (e.g. `admin`,` root`, `administrator`, `test`, `system`) on their very first attempt, saving database resources and thwarting brute-force dictionaries. #### ✅ 🛡️ Username Enumeration Shield Stops attackers and tools like WPScan from discovering valid login usernames by shielding direct author queries (`?author=1`) and removing user lists from the WordPress REST API for unauthenticated visitors. #### ✅ 🔍 Threat Intelligence & Forensic Investigation Integrated IP threat intelligence links (AbuseIPDB) directly in your activity logs and locked tables so you can investigate attacking IP reputations with one click. #### ✅ Trusted IP Allowlist Add your own IP address (or CIDR range) to the allowlist so you are never accidentally locked out. Lockspire shows you your current IP on the management screen, and warns you if you are about to make a change that could affect your own access. #### ✅ Detailed Activity Log Every failed and successful login attempt is logged to a dedicated database table with IP address, username, user-agent, and timestamp. Logs are filterable by event type and IP address, exportable to CSV, and automatically purged after a configurable retention period. #### ✅ Throttled Security Email Alerts Receive an email when an IP is locked out. Alerts are automatically throttled (one per IP per configurable time window) so a sustained attack doesn’t fill your inbox. You can also receive optional alerts for successful logins. #### ✅ Security Health Check A dedicated screen shows the real status of your site’s security configuration: login protection status, XML-RPC status, WordPress version, debug mode, wp-config. php permissions, default „admin“ username detection, honeypot auto-ban, user enumeration shielding, and trusted IP setup. Each check links directly to the right settings to fix any issues found. #### ✅ XML-RPC & Pingback Shield Completely disables XML-RPC and removes X-Pingback headers, eliminating common attack surfaces for brute-force and DDoS amplification attacks. Safe to disable for most sites. #### Who is Lockspire for? * WordPress site owners who want reliable brute-force protection without installing a heavyweight all-in-one security suite * Developers managing client sites who need a simple, trustworthy plugin they can configure once and leave running * Anyone who has been locked out of their own site before and wants a lockout recovery path built in #### What Lockspire does NOT do Lockspire does not scan for malware, provide a web application firewall, or offer country blocking. These features belong in a different category of plugin. Lockspire focuses exclusively on login access protection and does it reliably. #### Privacy Lockspire logs IP addresses, usernames, and browser user-agents for login events. This data is stored in your WordPress database and is never transmitted to external servers. It is automatically purged after your configured retention period (default: 30 days). We recommend documenting this in your site’s privacy policy. ### Developer Information **Hooks available to developers:** ``` lockspire_after_failed_login — Runs after a failed login attempt is recorded. ``` Parameters: `$username` (string), `$ip` (string), `$attempt_count` (int) ``` lockspire_after_lockout — Runs when an IP is locked out. ``` Parameters: `$username` (string), `$ip` (string) ``` lockspire_lockout_message — Filter the lockout message shown to the user. ``` Parameters: `$message` (string), `$minutes` (int), `$seconds` (int) **Option keys:** – `lockspire_options` — Main plugin settings array – `lockspire_trusted_ips`— Allowlisted IPs and CIDR ranges – `lockspire_notification_emails` — Additional alert recipient emails – `lockspire_email_logs` — Sent email log (capped at 100) **Table:** `{prefix}lockspire_log` — Login event log ## Instalacija 1. Upload the `lockspire-smart-access-protection` folder to the `/wp-content/plugins/` directory, or install it through the WordPress plugins screen. 2. Activate the plugin through the **Plugins** screen in WordPress. 3. Go to **Lockspire Dashboard** to see your site’s current protection status. 4. Visit **Lockspire Login Protection** to verify or adjust your lockout settings. 5. Optionally, go to **Lockspire Trusted IPs** and add your own IP to the allowlist. #### Default settings After activation, Lockspire immediately starts protecting your site with: * **5 failed attempts** before lockout (configurable: 1–100) * **15 minute** lockout duration (configurable: 1–1440 minutes) * XML-RPC disabled * Activity logging enabled (30-day retention) * Email alerts enabled for lockout events (throttled: max 1 per hour per IP) ## HSP ### I locked myself out. How do I get back in? The lockout expires automatically after the lockout duration you configured (default: 15 minutes). Alternatively: 1. Go to **Lockspire Login Protection** (from another IP or browser) and click ** Unlock** next to your IP. 2. For future prevention, add your IP to **Lockspire Trusted IPs** — it takes one click. ### Will this slow down my site? No. The lockout check runs only on login attempts and uses WordPress transients ( which are cached when object caching is active). On non-login pages, Lockspire adds zero overhead. ### Does this plugin create database tables? Yes. Lockspire creates a single table (`wp_lockspire_log`) to store login events. This allows reliable, searchable activity logs with automatic cleanup. The table is removed cleanly when you uninstall the plugin. ### Can I use this with other security plugins? Yes, Lockspire focuses narrowly on login attempt limiting and does not conflict with page-caching, firewall, or malware-scanning plugins. If you already use a plugin that limits login attempts, disable that feature in the other plugin to avoid double- processing. ### Is my current IP address safe to add to the trusted list? Lockspire shows your detected IP on the Trusted IPs screen. Most residential IP addresses change periodically (dynamic IP). If yours changes, the old trusted IP simply stops matching — it does not lock you out. For permanent protection, consider adding your ISP’s CIDR range or using a VPN with a static IP. ### Does Lockspire support reverse proxies / load balancers? By default, Lockspire only reads `REMOTE_ADDR` (the actual connection IP) to prevent IP spoofing. If your server sits behind a trusted reverse proxy that sets `X-Forwarded- For`, you can enable trusted-proxy mode in **Lockspire Settings Advanced**. Read the warning on that screen before enabling it. ### What data does Lockspire collect? Lockspire stores in your database: IP addresses, usernames, user-agent strings, and timestamps of login events. No data leaves your server. See the Privacy section in the plugin description for more detail. ## Pohódnoćenja Za tutón tykač pohódnoćenja njejsu. ## Sobuskutkowarjo a wuwiwarjo „Lockspire – Limit Login and Smart Access Protection“ je softwara wotewrjeneho žórła. Slědowacy ludźo su k tutomu tykačej přinošowali. Sobuskutkowarjo * [ ghimireanil ](https://profiles.wordpress.org/ghimireanil/) [Přełožće „Lockspire – Limit Login and Smart Access Protection“ do swojeje rěče.](https://translate.wordpress.org/projects/wp-plugins/lockspire-smart-access-protection) ### Na wuwiću zajimowany? [Přehladajće kod](https://plugins.trac.wordpress.org/browser/lockspire-smart-access-protection/), hladajće do [SVN-repozitorija](https://plugins.svn.wordpress.org/lockspire-smart-access-protection/) abo abonujće [wuwiwanski protokol](https://plugins.trac.wordpress.org/log/lockspire-smart-access-protection/) přez [RSS](https://plugins.trac.wordpress.org/log/lockspire-smart-access-protection/?limit=100&mode=stop_on_copy&format=rss). ## Protokol změnow #### 2.0.0 * **Security fix:** IP detection now uses only `REMOTE_ADDR` by default, preventing lockout bypass via spoofed `X-Forwarded-For` headers. Trusted proxy mode is available in Settings. * **New:** Dedicated custom database table for activity logging (replaces options- based 10-entry log). * **New:** Trusted IP allowlist with CIDR range support and self-lock protection warnings. * **New:** Security Health Check screen with actionable results for 8 real checks. * **New:** Email alert throttling (configurable window) prevents inbox flooding during sustained attacks. * **New:** Separate „notify on lockout“ vs. „notify on success login“ alert controls. * **New:** Log filtering by event type and IP address; CSV export. * **New:** Configurable log retention with automatic daily cleanup. * **New:** Configurable custom lockout message. * **Fix:** Email notifications were previously sent on every single failed attempt with no throttle. * **Fix:** Dashboard previously displayed hardcoded fake percentage changes („+ 12% from yesterday“). * **Fix:** Bot blocker was blocking Googlebot and all legitimate crawlers (now removed). * **Fix:** Activity log clearing had no CSRF protection (nonce now required for all destructive actions). * **Fix:** Version constant mismatch between plugin header and `define()` constant. * **Fix:** `includes/` files referenced `$this->` in standalone functions causing fatal errors (files cleaned up). * **Removed:** „Pro Coming Soon“ placeholder cards (no value to users). * **Removed:** Admin URL hiding feature (security-by-obscurity with high risk of self-lockout). * **Removed:** Overly aggressive bot-blocking firewall (blocked Googlebot, caused SEO damage). * **Changed:** Complete dashboard redesign — clean, honest, information-dense. * **Changed:** Plugin now uses `lockspire-security` text domain consistently. * **Changed:** Complete uninstall cleanup (options + table + transients). #### 1.0.1 * Minor fixes #### 1.0.0 * Initial release ## Meta * Version **2.0.0** * Last updated **21 hodźin** * Active installations **Mjenje hač 10** * WordPress version ** 5.6 abo nowši ** * Tested up to **6.7.10** * PHP version ** 7.4 abo nowši ** * Language * [English (US)](https://wordpress.org/plugins/lockspire-smart-access-protection/) * Tags * [authentication](https://hsb.wordpress.org/plugins/tags/authentication/)[Brute Force](https://hsb.wordpress.org/plugins/tags/brute-force/) [login](https://hsb.wordpress.org/plugins/tags/login/)[Login Attempts](https://hsb.wordpress.org/plugins/tags/login-attempts/) [security](https://hsb.wordpress.org/plugins/tags/security/) * [Rozšěrjeny napohlad](https://hsb.wordpress.org/plugins/lockspire-smart-access-protection/advanced/) ## Pohódnoćenja No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/lockspire-smart-access-protection/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/lockspire-smart-access-protection/reviews/) ## Sobuskutkowarjo * [ ghimireanil ](https://profiles.wordpress.org/ghimireanil/) ## Podpěra Chceće něšto prajić? Trjebaće pomoc? [Forum pomocy pokazać](https://wordpress.org/support/plugin/lockspire-smart-access-protection/)