=== GuardGiant ===
Contributors: guardgiant
Tags: login, brute force, security, protection, captcha, attack
Requires at least: 3.3
Tested up to: 5.6
Stable tag: 2.1.0
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Limit login attempts by using the modern approach of remembering your users trusted devices, ensuring you never lock out genuine users.

== Description ==

Limit login attempts by using the modern approach of remembering your users trusted devices, ensuring you never lock out genuine users.

**What Makes GuarGiant Better?**

When a genuine user makes a successful login to their account using their mobile phone, tablet, or computer GuardGiant starts treating their device as <mark>Trusted</mark>.

* Failed login attempts from trusted devices are directed towards 'Lost Password' forms rather than being subject to account lockouts or additional counter measures.
* Users receive an alert when anyone logs into their account from an unrecognized device or browser.

**Keeping Out The Bad Guys**

GuardGiant uses a range of counter-measures to limit failed login attempts from unrecognized devices. The default behaviour is:

* After 3 failed login attempts from the same device, a Google ReCaptcha field is added to the login page. ReCaptcha is a strong counter-measure that is very hard for an automated process to solve.
* After 10 failed login attempts a temporary block of 2 minutes is applied to the device/IP address. No login attempts can be made during this time.
* Each further failed login attempt increases the block time by another minute. This slows down attacks to the point where they quickly become unviable.


**Core Features:**

* Highly effective at preventing brute-force attacks.
* Does not impact genuine users who have lost their password etc.
* Attacks from unrecognized devices are met with strong counter measures.
* Works in the same way as many large websites such as Facebook, Google etc.

**Other Security Improvements**

GuardGiant implements other security improvements recommended by the Open Web Application Security Project® (OWASP) to keep your site safe:

* Obfuscates login errors to stop hackers detecting valid account names.
* Provides a searchable audit log of all login attempts.
* And much, much more.

This plugin is exceptionally easy to use no matter what your level of technical expertise. The default settings are highly optimized, designed to keep attackers at bay whilst not disturbing genuine users from logging in. Advanced users can fully customize the behaviour of this plugin to suit their own environment.

== Installation ==

How to install the plugin

**Using the WordPress dashboard**

* Navigate to 'Plugins' in the WordPress dashboard.
* Click on 'Add new' to add a new plugin.
* Search for ‘GuardGiant’
* Click ‘Install Now’
* Click the 'Activate' link when your download has completed.


**Uploading files via the WordPress Dashboard**

* Navigate to 'Plugins' in the WordPress dashboard.
* Click on 'Add new' to add a new plugin.
* Click on 'Upload Plugin' at the top of the page.
* Click 'Choose File'
* Select guardgiant.zip from your computer
* Click ‘Install Now’
* Click the 'Activate' link when your download has completed.


== Frequently Asked Questions ==

= What level of expertise no I need to configure this plugin? =

This plugin is exceptionally easy to use no matter what your level of technical experience. The default settings are highly optimized, designed to keep attackers at bay whilst not disturbing genuine users from logging on.

For advanced users, you can fully customize the behaviour of the plugin to ensure it works best for your application.

= Is this plugin compatible with Cloudflare or other CDNs? =

Yes.

Load balancers and CDNs are known as reverse proxies. Due to the nature of these services, all visits to your website are logged with the IP address of the proxy rather than the visitor’s actual IP address. To remedy this, the visitor's IP address is provided in a 'header field' which GuardGiant will pick up and use.

== Screenshots ==

1. Recent login activity.
2. Login screen when reCaptcha has been deployed.
3. New device sign on email.
4. Main settings page.

== Changelog ==

= 2.1.0 =
* Initial release to WordPress