Authorizer
Authorizer restricts access to a WordPress site to specific users, typically students enrolled in a university course. It maintains a list of approved users that you can edit to determine who has access. It also replaces the default WordPress login/authorization system with one relying on an external server, such as Google, CAS, LDAP, or an OAuth2 provider. Finally, Authorizer lets you limit invalid login attempts to prevent bots from compromising your users’ accounts. View or contribute to the plugin source on GitHub: https://github.com/uhm-coe/authorizer Authorizer requires the following: CAS server (2.x, 3.x, 4.x, 5.x, 6.x, or 7.x) or LDAP server (plugin needs the URL) PHP extensions: php-ldap, php-curl, php-dom Authorizer provides the following options: Authentication: WordPress accounts; Google accounts; CAS accounts; LDAP accounts; OAuth2 accounts Login Access: All authenticated users (all local and all external can log in); Only specific users (all local and approved external users can log in) View Access: Everyone (open access); Only logged in users Limit Login Attempts: Progressively increase the amount of time required between invalid login attempts. Shortcode: Use the [authorizer_login_form] shortcode to embed a wp_login_form() outside of wp-login.php.
Orbisius Limit Logins
This plugin logs and blocks IP address of users who try to login with known bad usernames such as admin, adm etc. The plugin intentionally hooks very early (plugins_loaded hook) in order to determine if the user should be blocked or not because that way WordPress doesn’t have to waste resources if the user is supposed to be blocked. It stores the IP address in the uploads folder (.htaccess protected) so it doesn’t hit the database for the ip checks. This may not work on some setups. The user will get blocked in these cases: – Tries to login using one of the bad usernames (admin, adm, root, administrator) – Tries 7 or more ties to guess any password of any user Note: If you still have an account whose username matches the logins mentioned above please create a new admin account and use that one instead .. or you will get banned when you attempt to login regardless if your password was valid or not. When the user should be blocked the plugin outputs Internal Server Error message and stop. That way the attacked doesn’t know what’s happening. Also the user is has to wait between 3 and 15 seconds before seeing this error message to slow him/her down. Features / Benefits Hooks very early and checks if the user is blocked -> blocks to saves resources Doesn’t block server’s ip or localhost / 127.0.0.1 The plugin should be capable of detecting multiple IP address of a visitor (some proxies pass the original IP address via different request variable) If an IP is blocked that user is not allowed to access the whole site not just the login page. Extensible via hooks (filters, actions). Demo TODO Bugs? Suggestions? If you want a faster response contact us through our website’s contact form [ orbisius.com ] and not through the support tab of this plugin or WordPress forums. We don’t get notified when such requests get posted in the forums. Support is handled on our site: http://club.orbisius.com/forums/ Please do NOT use the WordPress forums or other places to seek support. Author Svetoslav Marinov (Slavi) | Custom Web and Mobile Programming by Orbisius.com
