A litte more secure for WordPress

Stop bots from brute force hacking your wp-login.php

A request to wp-login.php without an unlock parameter answers with a 404 and a

holding page. JavaScript counts down a few seconds, then redirects to the same

URL with the parameter appended. Only that request renders a usable login form,

and only it carries the nonce that a login POST has to contain — a POST without

a valid nonce is rejected.

This raises the cost of naive automation. It is not a lockout mechanism: whoever

requests the unlock URL first can read the nonce and post with it, which is why

the plugin is called a little more secure.

There is nothing to configure. Activating the plugin is enough.

Customising Three filters, for a theme or a small plugin of your own.

a_little_more_secure_is_unlocked decides whether a request counts as unlocked.

By default that is the presence of the parameter; override it to implement your

own rule, for example a one-time token or an office IP allowlist:

add_filter( 'a_little_more_secure_is_unlocked', function ( $is_unlocked ) { return $is_unlocked || my_own_check(); } );

a_little_more_secure_get_param_name changes the name of the unlock parameter, a-little-more-secure by default.