Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention vs European VAT Compliance Assistant for WooCommerce

Protect your WordPress website against brute force attacks, bot attacks, and unauthorized login attempts with one of the most trusted login security plugins for WordPress. Limit Login Attempts Security strengthens your WordPress login security by limiting failed login attempts, blocking malicious IPs, securing wp-login.php, protecting XML-RPC, and adding powerful firewall and 2FA protection without slowing down your website. Trusted by 2 million WordPress websites, Limit Login Attempts Security is designed specifically to protect the most targeted part of your website: the login page. Why Use Limit Login Attempts Security? By default, WordPress allows unlimited login attempts. This creates a major security vulnerability where bots and attackers can repeatedly guess usernames and passwords until they gain access. This is especially important in the age of AI, where attackers now have access to faster and more sophisticated tools than ever before. Limit Login Attempts Security helps stop: Brute force attacks Bot login attacks Credential stuffing attacks XML-RPC attacks Unauthorized login attempts WooCommerce login abuse Malicious IP access attempts The plugin automatically blocks excessive login attempts and locks out suspicious IP addresses and usernames before attackers can gain access. Features Included in the Free Version Login Security & Brute Force Protection Limit login attempts by IP address and username Automatically lock out suspicious login activity Adjustable lockout duration and retry limits Protect wp-login.php from automated attacks Prevent brute force login attacks 2FA / Multi-Factor Authentication (MFA) Built-in two-factor authentication (2FA) Add an additional layer of login protection Improve WordPress account security Secure administrator and user logins Firewall & Bot Protection Block malicious login requests Detect suspicious login behavior Reduce bot-based login attacks Lightweight firewall-focused login protection WooCommerce & Plugin Compatibility Protects: WooCommerce login pages XML-RPC login requests Custom login pages WordPress multisite installations Compatible With: Wordfence Sucuri Ultimate Member MemberPress WPS Hide Login Cloudflare and reverse proxy setups Login Monitoring & Notifications Failed login attempt logs Lockout email notifications Denied attempt tracking Login retry visibility for users Access Controls IP safelist and denylist support Username safelist and denylist support IPv6 range support Custom IP origin configuration Premium Features (Start Your Free 14 Day Trial) Upgrade to Limit Login Attempts Security Premium to extend protection with cloud-based login security and advanced attack prevention. Advanced Cloud Protection Real-time malicious IP intelligence Global denylist protection Synchronized lockouts across websites Auto IP denylist generation Cloud-based login attack mitigation Enhanced Performance Protection Offload excessive failed login requests from your server Reduce server strain during attacks Improve stability under heavy attack conditions Advanced Security Features Country-based login blocking Enhanced throttling and lockout escalation Registration page protection Successful login tracking Enhanced lockout analytics and geolocation data Multi-Site & Team Features Shared safelist and denylist syncing Shared lockout protection between domains Cloud backups of IP security data CSV exports of login and IP activity Premium Support Access to security-focused support specialists Faster troubleshooting and assistance Lightweight Security Built for WordPress Unlike many large security suites, Limit Login Attempts Security focuses specifically on login security and brute force protection. This means: Faster performance Less server overhead Easier configuration Strong protection without unnecessary bloat Protect More Than Just wp-login.php Limit Login Attempts Security secures: wp-login.php XML-RPC WooCommerce logins Custom login forms Registration pages Multisite logins Trusted by Millions of WordPress Websites Limit Login Attempts Security is one of the most widely used WordPress login security plugins and has helped protect millions of websites from brute force attacks and malicious login activity. Whether you run: A personal blog WooCommerce store Membership website Agency Business website Enterprise WordPress network Limit Login Attempts Security helps secure your login experience with modern WordPress login protection. Upgrading from the Original Limit Login Attempts Plugin? Switching is easy: Remove the old Limit Login Attempts plugin Install Limit Login Attempts Security Your settings will remain intact Translation Support Currently translated into multiple languages including: Spanish French German Dutch Turkish Swedish Russian Romanian Chinese (Traditional) Brazilian Portuguese And more Secure Your WordPress Login Today Install Limit Login Attempts Security and protect your WordPress website with: Login security Two-Factor Authentication (2FA) Brute force protection Firewall security Bot protection XML-RPC protection WooCommerce login protection Without slowing down your website.

The European/UK VAT (IVA) laws Since January 1st 2015, all digital goods (including electronic, telecommunications, software, ebook and broadcast services), and from 1st July 2021 physical goods sold across EU and UK borders have been liable under law to variable VAT (a.k.a. IVA) charged in the country of purchase, at the VAT rate of that country (background information: https://taxation-customs.ec.europa.eu/system/files/2016-09/explanatory_notes_2015_en.pdf). This can apply even if the seller is not based in the EU or UK. It is accompanied by various auditing/recording requirements. How this plugin can take away the pain This WooCommerce plugin provides features to assist with EU, UK, Norwegian and Swiss VAT law compliance. Currently, those features include: Identify your customers’ locations: this plugin will record evidence of your customer’s location, using their billing or shipping address, and their IP address (via a GeoIP lookup). Evidence is recorded, ready for audit: full information that was used to calculate VAT and customer location is displayed in the WooCommerce order screen in the back-end. Display prices including correct VAT from the first page: GeoIP information is also used to show the correct VAT from the first time a customer sees a product. A widget and shortcode are also provided allowing the customer to set their own country. Currency conversions: Most users (if not everyone) will be required to report VAT information in a specific currency. This may be a different currency from their shop currency. This feature causes conversion rate information to be stored together with the order, at order time. Currently, you can choose from official rates from the European Central Bank (ECB), Danish and Czech National Banks, the Central Bank of the Russian Federation, and HM Customs & Revenue (UK). You can also over-ride the currency and rate-provider on a per-country basis. Entering and maintaining each country’s VAT rates: this plugin assists with entering EU and/or UK VAT rates accurately by supplying a single button to press in your WooCommerce tax rates settings, to add or update rates for all countries (standard or reduced) with one click. Reporting: Advanced reporting capabilities, allowing you to see all the information needed to make a OSS/MOSS/IOSS (one-stop shop) VAT report. The report is sortable and broken down by country, VAT rate, VAT type (traditional/variable) and order status, and can be exported as a CSV. Forbid vatable sales if any goods have VAT chargeable – for shop owners for whom VAT compliance is too burdensome, this feature will allow you to forbid customers from configured VAT territories to check-out if they have selected any goods which are subject to VAT (whilst still allowing purchase of other goods, unlike the built-in WooCommerce feature which allows you to forbid check-out from some countries entirely). Central control: brings all settings, reports and other information into a single centralised location, so that you don’t have to deal with items spread all over the WordPress dashboard. Mixed shops: You can sell goods subject to your chosen territories’ VAT under the customer-place-of-supply regulations and any other physical goods which are subject to traditional base-country-based VAT regulations. The plugin supports this via allowing you to identify which tax classes in your WooCommerce configuration are used for customer-place-of-supply items. Products are allocated to the correct country according to which country VAT is payable to. Distinguish VAT from other taxes: if you are in a jurisdiction where you have to apply other taxes also, then this plugin can correctly distinguish which taxes are payable to which jurisdictions. Add line to invoices: If VAT was paid on the order, then an extra, configurable line can be added to the footer of the PDF invoice (when using the the free WooCommerce PDF invoices and packing slips plugin, or its premium counterpart). Refund support: includes information on refunded VAT, on relevant orders. Same prices: Not strictly a VAT compliance issue (different pricing per-country is not illegal), but this plugin adds an option to enable WooCommerce’s hidden support for adjusting pre-tax prices to enable the same post-tax (net) price to apply in all customer locations. Brexit-ready: The plugin has been audited and appropriately adapted to be usable by both “EU 27” and UK (and other) countries after the expiry of the EU and UK’s transitional period (at the end of December 2020), including the ability to report taxes in multiple currencies using different exchange rate providers. Existing users should take the time to go through their existing settings to adapt to their new situation (e.g. remove tax table entries for countries that they are no longer required to remit taxes to; check that they are using the correct exchange rate provider and reporting currency for each tax region that they remit to). WooCommerce high-performance order storage: This plugin is HPOS-compatible (see: https://woocommerce.com/document/high-performance-order-storage/) WooCommerce block cart/checkout: This plugin is compatible with the WooCommerce block cart and checkout (see: https://woocommerce.com/checkout-blocks/), as well as the traditional shortcode cart/checkout. A Premium version is on sale at this link, and currently has these additional features ready: VAT-registered buyers can be exempted, and their numbers validated: a VAT number can be entered at the check-out, and it will be validated (via VIES, HMRC or VatSense). Qualifying customers can then be exempted from VAT on their purchase, and their information recorded. The customer’s VAT number will be appended to the billing address where shown (e.g. order summary email, PDF invoices). An extra, configurable line specific to this situation can be added to the footer of the PDF invoice (when using the the free WooCommerce PDF invoices and packing slips plugin). Partial VAT exemption: make VAT-exemption upon supply of a valid VAT number to only apply to products in tax classes specified by the shop owner (rather than to all products) Optionally allow B2B sales only – for shop owners who wish to only make sales that are VAT-exempt (i.e. B2B sales only), you can require that any EU and/or UK customers (optionally including or excluding those in your country) enter a valid VAT number at the check-out. (You can have different policies for different VAT regions). Change taxation rules based upon year-to-date sales thresholds: for shop owners who can or must tax differently based upon their total sales in the year so far (e.g. EU shop owners who can take advantage of a €10,000 threshold for cross-border sales before which they can treat the place of supply as being their own, not the customer’s location), you can dynamically treat products as having a different taxation class until this threshold is met. CSV download: A CSV containing comprehensive information on all orders with VAT data from your configured regions can be downloaded (including full compliance information). Manipulate in your spreadsheet program to make arbitrary calculations. Non-contradictory evidences: require two non-contradictory evidences of location (if the customer address and GeoIP lookup contradict, then the customer will be asked to self-certify his location, by choosing between them). Show multiple currencies for VAT taxes on PDF invoices produced by the free WooCommerce PDF invoices and packing slips plugin (and on credit notes produced by its Premium counterpart). Support for the official WooCommerce subscriptions extension, and for Subscriptio (a RightPress/CodeCanyon alternative), and Subscriben. Value-based exemption: An order can have VAT removed if the order value passes a configured value and is for a specified country. This features was developed to support the UK’s 2021 regulations for handling VAT differently on an order depending on whether or not the order passes a £135 threshold value, and then expanded to support multiple rules for different countries and amounts. Read more about the Premium version of this plugin at this link. It is believed (but not legally guaranteed), that armed with the above capabilities, a WooCommerce shop owner will be in a position to fulfil the requirements of EU or UK VAT laws: identifying the customer’s location and collecting multiple pieces of evidence, applying the correct VAT rate, validating VAT numbers for B2B transactions, and having the data needed to create returns. (If in the EU or UK, then you will also need to make sure that you are issuing your customers with VAT invoices containing the information required in your jurisdiction, via a suitable WooCommerce invoice plugin). Footnotes and legalese This plugin is supported on, and information in this document is for, WooCommerce 4.5 up to the latest release (i.e. current version; you can still download older versions supporting previous WooCommerce release series if you wish). It fetches data on current VAT rates from Amazon S3 (using SSL if possible); or, upon failure to connect to Amazon S3, from https://raw.githubusercontent.com. If your server’s firewall does not permit this, then it will use static data contained in the plugin. Geographical IP lookups are performed via WooCommerce’s built-in geo-location features; or, alternatively, if you use CloudFlare, then you can activate the CloudFlare feature for sending geographical information. In some situations, these lookups may be performed via the public API at https://ipapi.co – if this is undesirable for you, then add define('WC_VAT_COMPLIANCE_DO_REMOTE_IP_LOOKUPS', false); to your wp-config.php file. Please make sure that you review this plugin’s installation instructions and have not missed any important information there. Please note that, just as with WordPress and its plugins generally (including WooCommerce), this plugin comes with no warranty of any kind and you deploy it entirely at your own risk. Furthermore, nothing in this plugin (including its documentation) constitutes legal or financial or any other kind of advice of any sort. In particular, you remain completely and solely liable for your own compliance with all taxation laws and regulations at all times, including research into what you must comply with. Installing any version of this plugin does not absolve you of any legal liabilities, or transfer any liabilities of any kind to us, and we provide no guarantee that use of this plugin will cover everything that your store needs to be able to do. Whether you think the EU’s treaties with other jurisdictions will lead to success in enforcing the collection of taxes in other jurisdictions is a question for lawyers and potential tax-payers, not for software developers! Many thanks to Diego Zanella, for various ideas we have swapped whilst working on these issues. Thanks to Dietrich Ayala and other authors, whose NuSOAP library is included under the LGPLv2 licence. Other information Some other WooCommerce plugins you may be interested in This plugin is ready for translations (English, Dutch, Finnish, French and German are currently available), and we would welcome new translations (please post them in the support forum; the POT file is here, or you can contact us and ask for a web-based login for our translation website). License This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA