Allow Only Administrators to Log In
Temporarily blocks logins for everyone except administrators, for example during a migration or a security incident.
Snippet Library
Login snippets for WordPress
Snippets for the WordPress login page and the way people sign in: your logo and colors, a custom redirect after login, friendlier error messages and limits on who can get in. For anyone who wants a branded, safer login without another plugin.
Block Password Resets for Administrators
Disables the "Lost your password?" flow for administrator accounts, which closes off reset-email based takeovers of the most powerful accounts.
Disable Password Resets for Everyone
Turns off the "Lost your password?" feature for all users, for sites where accounts are managed only by an administrator.
Emailed Login Code for Staff Accounts
Adds a second step for administrators and editors: after the correct password, WordPress emails a 6-digit code that must be entered to finish logging in.
Log Users Out Everywhere When Their Role Changes
Ends all of a user's active sessions as soon as an administrator changes or removes their role, so a demoted account cannot keep using old access.
Make New Users Change Their Password on First Login
When an administrator creates an account, the new user is sent to their profile and asked to choose a new password before they can use the rest of the site.
Reject Login Attempts for Common Usernames
Refuses login attempts for usernames bots love to try, such as "admin", "administrator" or "root", before WordPress even checks a password.
Send Non-Editors to the Homepage After Login
Users who cannot edit posts (subscribers, customers) land on the homepage after logging in instead of their admin profile. Staff still go to the dashboard.
Shorter Login Sessions for Administrators
Makes administrator logins expire sooner than everyone else's, limiting the damage of a forgotten logged-in browser.
Show Your Previous Login Time After Logging In
Greets users in the admin with the date, time and IP address of their previous login, so they can spot logins they do not recognize.