Login Security & MFA

Description

Most store compromises don’t start with anything a customer does — they start with automated bots constantly scanning the internet for the standard admin login page every WordPress site normally uses, then hammering it with guessed or leaked passwords. This closes that door without adding any friction for shoppers.

Three layers work together. First, the admin login isn’t reachable at the standard address anymore — anyone or anything that doesn’t already have the correct private link finds nothing to attack in the first place. Second, a password alone can no longer complete an administrator login: a one-time code is sent to the account holder’s own email at the moment of login, so a guessed, leaked, or reused password is useless without also controlling that inbox. Third, repeated login attempts are automatically throttled and temporarily blocked — enough to make automated password-guessing pointless, while a real person who mistypes their password once or twice is barely inconvenienced.

Customers are completely unaffected — storefront checkout and customer account login work exactly as before, with no new steps and no delay. Administrator-level accounts get the private link plus the one-time email code at every login; other staff roles can be configured to need just the private link, without the extra step, depending on how much access that role actually has. Nothing about the storefront’s appearance or behavior changes for a shopper, a search engine, or Google Merchant Center — only what staff see behind the scenes when logging in.

Competitor benchmark: premium WordPress login-security plugins bundling two-factor authentication, brute-force protection and login-URL masking typically run $70–149/year single-site (Jetpack Security from $70/year; Wordfence Premium and Sucuri Premium at $149/year). Priced at the low end of that range.