=== Limit Login Attempts - GuardGiant ===
Contributors: guardgiant
Tags: limit login attempts, brute force protection, brute force attack, login security, limit failed logins, login attempts, limit login, captcha, protect admin login, devices, trusted devices, guard giant
Requires at least: 3.3
Tested up to: 5.6
Stable tag: 2.2.0
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Limit login attempts using trusted devices, the modern approach to login security. Stops hackers but does not lock out genuine users. 

== Description ==

Limit login attempts using trusted devices, the modern approach to login security. Stops hackers but does not lock out genuine users.

**Login Security**

When a genuine user makes a successful login to their account using their mobile phone, tablet, or computer GuardGiant starts treating their device as <mark>Trusted</mark>.

* Failed login attempts from trusted devices are directed towards 'Lost Password' forms rather than being subject to account lockouts or additional counter measures.
* Users receive an alert when anyone logs into their account from an unrecognized device or browser.

**Limit Login Attempts**

GuardGiant uses a range of counter-measures to limit failed login attempts from unrecognized devices. The default behaviour is:

* After 3 failed login attempts from the same unrecognized device, a Google ReCaptcha field is added to the login page. ReCaptcha is a strong counter-measure that is very hard for an automated process to solve.
* After 10 failed login attempts a temporary block of 2 minutes is applied to the device/IP address. No login attempts can be made during this time.
* Each further failed login attempt increases the block time by another minute. This slows down attacks to the point where they quickly become unviable.

**Features**

* Brute force protection - limit login attempts made by attacking device/IP address.
* Login security does not impact genuine users who have lost their password etc.
* Detailed logging of all login attempts.
* Uses the same security approach as many large websites such as Facebook, Google etc.

**Other Security Improvements**

GuardGiant implements other security improvements recommended by the Open Web Application Security Project® (OWASP) to keep your site safe:

* Obfuscates login errors to stop hackers detecting valid account names.
* Provides a searchable audit log of all login attempts.
* And much, much more.

This plugin is exceptionally easy to use no matter what your level of technical expertise. The default settings are highly optimized, designed to keep attackers at bay whilst not disturbing genuine users from logging in. Advanced users can fully customize the behaviour of this plugin to suit their own environment.

== Installation ==

How to install the plugin

**Using the WordPress dashboard**

* Navigate to 'Plugins' in the WordPress dashboard.
* Click on 'Add new' to add a new plugin.
* Search for ‘GuardGiant - limit login attempts’
* Click ‘Install Now’
* Click the 'Activate' link when your download has completed.


**Uploading files via the WordPress Dashboard**

* Navigate to 'Plugins' in the WordPress dashboard.
* Click on 'Add new' to add a new plugin.
* Click on 'Upload Plugin' at the top of the page.
* Click 'Choose File'
* Select guardgiant.zip from your computer
* Click ‘Install Now’
* Click the 'Activate' link when your download has completed.


== Frequently Asked Questions ==

= What level of expertise do I need to configure this plugin? =

This plugin is exceptionally easy to use no matter what your level of technical experience. The default settings are highly optimized, designed to keep attackers at bay whilst not disturbing genuine users from logging on.

For advanced users, you can fully customize the behaviour of the plugin to ensure it works best for your application.

= Is this plugin compatible with Cloudflare or other CDNs? =

Yes.

Load balancers and CDNs are known as reverse proxies. Due to the nature of these services, all visits to your website are logged with the IP address of the proxy rather than the visitor’s actual IP address. To remedy this, the visitor's IP address is provided in a 'header field' which GuardGiant will pick up and use.

== Screenshots ==

1. Recent login activity.
2. Login screen when reCaptcha has been deployed.
3. New device sign on email.
4. Main guard giant settings page.

== Changelog ==

= 2.2.0 =
* Added the ability to disable XMLRPC to reduce attack vectors
* Performance improvements 

= 2.1.1 =
* Improvements to the IP address geolocation feature

= 2.1.0 =
* Initial release to WordPress