Login
v1.4.0Brand the WordPress login screen, then protect it — brute-force lockouts, a self-hosted CAPTCHA, passwordless magic-link login, two-factor authentication, a login history, and smart login/logout redirects.
Overview
The Login module restyles the standard WordPress login page and hardens it against brute-force and bot attacks — with login/logout redirects on top.
Login gives the wp-login.php screen your branding without changing its address, then adds the protection most sites reach for a second plugin to get. Everything lives under three tabs — Style, Security and Login/out — in WPStack → Login.
- Style — logo, background (colour, gradient or image), login-box layout, colours, fonts, buttons, custom CSS, and one-click style presets
- Security — limit login attempts, a bot honeypot, generic errors, an XML-RPC switch, a self-hosted CAPTCHA, passwordless magic-link login and two-factor authentication
- Login/out — redirect users after login (globally or per role) and after logout
- History — a log of every sign-in across all users, showing the method used (password, magic link…)
- No change to your login URL — bookmarks and password managers keep working
Requirements
Login runs on any modern WordPress host — there is nothing to configure to get started.
| Requirement | Minimum | Recommended |
|---|---|---|
| WordPress | 6.0 | 6.5 or newer |
| PHP | 7.4 | 8.1 or newer |
| HTTPS | Recommended | Site-wide |
Installation & activation
Login ships inside WPStack — switch it on per site from the modules panel.
Open the WPStack modules panel
In your WordPress admin, go to WPStack → Modules and find Login.
Activate Login
Flip the Login toggle on. A new Login item appears in the WPStack menu.
Style, protect, redirect
Open WPStack → Login and work through the Style, Security and Login/out tabs.
Style
The Style tab controls how the login screen looks. Changes preview live and apply to the standard login URL.
| Setting | Type | Default | What it does |
|---|---|---|---|
| Quick styles | preset | — | One-click ready-made designs (Classic, Minimal, Midnight, Aurora, Ocean, Sunset) that fill in a full look — then fine-tune. Your logo and text are kept. |
| Logo | image + link | WP logo | Upload your logo and set its width, link URL and alt text. |
| Background | colour / gradient / image | Solid colour | Fill the page with a solid colour, a gradient (with angle) or a cover image. |
| Login box | layout | Centered | Position, width, padding, corner radius, shadow and background of the login card. |
| Colors | colour set | — | Primary/button, button text, link, label and input border/focus colours. |
| Typography | font + size | System | A Google font (Inter, Roboto, Lato, Poppins, Montserrat) or the system stack, plus base size. |
| Buttons & inputs | radius + text | — | Corner radius for the button and inputs, and optional custom button text. |
| Visibility | toggles | All shown | Show or hide the “Back to site” link, “Lost password” link and language switcher. |
| Footer text | text | — | A line of text shown under the login form. |
| Custom CSS | code | — | Injected after the generated styles for any fine-tuning. |
Security
The Security tab hardens the login form against brute-force and bot attacks, and adds a self-hosted CAPTCHA, passwordless magic-link login and two-factor authentication. Every feature is off until you switch it on.
| Setting | Type | Default | What it does |
|---|---|---|---|
| Limit login attempts | toggle | Off | Lock out an IP after too many failed logins. |
| Max attempts | number | 5 | Failed logins allowed before the IP is locked out. |
| Lockout (minutes) | number | 15 | How long the lockout lasts; it clears itself when the window expires. |
| Login honeypot | toggle | Off | Adds a hidden trap field that silently blocks spam bots. |
| Generic error messages | toggle | Off | Show one neutral error instead of revealing whether the username or password was wrong. |
| Disable XML-RPC | toggle | Off | Turn off XML-RPC to close a common attack surface. |
| Magic link login | toggle | Off | Let users request a one-time login link by email — no password needed. |
| Link lifetime (minutes) | number | 15 | How long a magic link stays valid; each link is single-use. |
| Allow for administrators | toggle | Off | Off by default — a compromised inbox could take over an admin account. |
| Two-factor authentication | toggle | Off | Let users add a TOTP authenticator app. Each user turns it on from their own profile under Users → Profile. |
| CAPTCHA | off / question / invisible | Off | Add a self-hosted challenge: a simple question (accessible, no JavaScript) or an invisible proof-of-work puzzle. |
| CAPTCHA — apply to | checkboxes | All | Which forms show the CAPTCHA — Login, Registration and/or Lost password. |
Login / logout redirects
The Login/out tab decides where people land after signing in and after signing out.
| Setting | Type | Default | What it does |
|---|---|---|---|
| After login | select | WP default | Send users to the WordPress default, the admin dashboard, the site home, or a custom URL. |
| Custom URL (login) | url | — | Used when “Custom URL” is chosen for after-login. |
| Per-role overrides | url per role | — | Optionally send specific roles somewhere different — overrides the global after-login target. |
| After logout | select | Login screen | Send users to the login screen (default), the site home, or a custom URL after logging out. |
Login history
The History tab keeps a running log of every sign-in across all users — how they logged in, from where, and when.
Every successful login is recorded with the method used — password, magic link, XML-RPC or REST — plus the user, IP address, device (browser and OS) and time. Failed attempts are logged and flagged too, so password-guessing is easy to spot.
- Columns: When · User · Method · Status · IP · Device
- Filter by All / Successful / Failed, paginated
- One-click Clear history
- Stored in its own table — nothing added to your front end
FAQ
No — it restyles and protects the standard WordPress login screen; the address is unchanged.
Only temporarily, after repeated failed attempts from your IP. You set the attempt limit and lockout minutes, and it clears itself when the window expires.
It can affect the WordPress mobile app and some Jetpack features. It is off by default — only enable it if you do not use those.
Yes — set a global after-login destination plus per-role overrides, and choose where logout goes too.
Yes — enable magic-link login and users can request a one-time sign-in link by email. Links are single-use, short-lived and hashed; administrators are opt-in.
Yes — the History tab logs every sign-in across all users (method, IP, device, time) with failed attempts flagged. You can filter and clear it.
Yes — like every WPStack module, Login is included in every plan.