Description
This plugin allows you to restrict the login on your website, based on the custom rules you apply. This helps with tightening your website security and fights against dictionary bot attacks originating from other countries, by denying access.
By default, upon activation, the plugin does not apply any restriction. You can configure the plugin to allow the login only from specified IPs or from specified countries. Additionally, the plugin allows for redirects to the front page when the default “Login” and “Register” URLs are accessed by someone that has a restriction. You can also specify other custom URLs to be redirected to the front page as well, following the same restriction rules.
The PRO version includes other useful features.
Rule Type
Login Restriction Rules
The login filter can be configured to work in a different way, depending on what type of rules to be assessed and in which order.
- Allow login only for allowed countries or allowed IPs
- Block login only for blocked countries or blocked IPs
- Allow login only for allowed countries or allowed IPs, but not from blocked IPs
- Allow login only for allowed countries or allowed IPs, but not from blocked IPs or blocked countries
- Block login only for blocked countries or blocked IPs, but not for allowed IPs
- Block login only for blocked countries or blocked IPs, but not for allowed IPs or allowed countries
Filter XML-RPC authenticated methods
This new option controls whether XML-RPC methods requiring authentication (such as for publishing purposes) are enabled or not. This option does not interfere with pingbacks or other custom endpoints that don’t require authentication. There are 3 options:
- Default
- Disable all
- Disable only when matching a restriction rule
IP Restriction
If you chose to set a login restriction by IP, then you have to add your own IP to the list. This is done automatically starting with version 6.0. If you are using the plugin in a local setup the IP is 127.0.0.1 or ::1, this is added in your list by default.
Starting with version 6.0, the plugin has new options for blocking specific IPs.
Country Restriction
The plugin allows for selecting the countries from where the login would be allowed and also selecting the countries from where the login to be blocked.
Redirects
You can use redirects to the front page when the URLs are accessed by someone that has a restriction, for the login page, the registration page, and other specified URLs.
Other Settings
Redirect Restricted Login
When the user attempts to authenticate, and the account is restricted either by IP or country, if the role is not in the list of bypassed roles, then the user will see a plain “Forbidden!” message. If you enable this option, the page will redirect to your “404” page instead of that or will display a the forbid message that can be customized.
There are two options:
- Header 404 – Redirect the visitor to the site’s “Not Found” page.
- Header 403 – Show “Forbidden Access” and the custom message.
Lockout duration
When a user attempts to authenticate and the restriction kicks in, the user will not be able to login in the next hour (the default duration is 60 minutes). You can change the lockout duration if necessary.
Individual lockout
If for various reasons, you need to temporarily disable the login for a specific user, you can enable this option. With the setting on, you can edit the user account(s) you wish to restrict. You will see the list of restricted users on the plugin settings page.
Don’t worry, you can revert this option at any time. If you need to grant access back to all the user accounts you restricted, just uncheck the individual logout option in the settings.
WooCommerce Integration
With this setting, you can instruct Login IP & Country Restriction plugin to auto-adapt to new customers on your WooCommerce shop, so that their country to automatically be added to the list of allowed countries. This grants them login access right away.
Bypass the IP and country restriction for the specified roles
You have to option to bypass the login restriction that you put in place (based on the country or IP) for specific user roles.
This is useful for online shops, where your customers place orders then authenticate on your website. This happens from various locations that might not be included in the allowed IPs or countries filters, and using this feature would grant them access to their accounts right away.
Single IP Login Per User
If this option is enabled, the users will be allowed only from the first IP they had when they first log in. Don’t worry, you can revert this option at any time, and also reset the IP for individual users.
Simulate IP and Country
Temporarily disable all settings
If for various reasons, you need to temporarily disable all restrictions and any other settings of this plugin, you can use this option, without losing the current settings.
Information about the restriction based on the combination of IP + country + rule type
