How to Secure Your WordPress Login with Loginizer Pro
Loginizer Pro is included free with every Unisolva hosting plan and is pre-installed on your WordPress site. It protects your WordPress login page from brute-force attacks - the most common method hackers use to gain access to WordPress sites. This article shows you how to configure Loginizer Pro for maximum protection.
Prerequisites
- WordPress installed on your Unisolva hosting account
- Loginizer Pro active in WordPress (go to Plugins > Installed Plugins and verify Loginizer Security is Active)
|
???? Note If Loginizer Pro shows as inactive or unlicensed, open a support ticket at my.unisolva.com and our team will activate the license for you - typically within a few hours. |
How Loginizer Pro Works
Loginizer Pro monitors login attempts to your WordPress site. When an IP address fails to log in a set number of times, Loginizer blocks it from making further attempts. This stops automated bots from guessing your password through thousands of rapid attempts.
Step 1 - Access Loginizer Settings
- Log in to your WordPress dashboard at yourdomain.com/wp-admin
- In the left menu, click Loginizer Security
- The Loginizer dashboard shows you a live feed of recent login attempts and blocked IPs
Step 2 - Configure Brute Force Protection
- Go to Loginizer Security > Brute Force
- Configure the core settings:
- Max Retries - the number of failed login attempts allowed before blocking (recommended: 3–5)
- Lockout Time - how long an IP is blocked after reaching max retries (recommended: 15–30 minutes)
- Max Lockouts - number of lockouts before the IP is blacklisted permanently (recommended: 3)
- Blacklist Time - how long a permanently blacklisted IP stays blocked (recommended: 24 hours or higher)
- Click Save Settings
|
???? Tip Start with conservative settings (5 retries, 15 minute lockout) to avoid accidentally locking yourself out. If you have a static IP address, you can add it to the whitelist under Loginizer Security > IP Management > Whitelist to ensure you are never locked out. |
Step 3 - Enable Two-Factor Authentication (2FA)
Two-Factor Authentication (2FA) requires users to enter a one-time code from an authenticator app in addition to their password. Even if a hacker knows your password, they cannot log in without your phone.
- Go to Loginizer Security > Two Factor Auth
- Enable 2FA for Administrator accounts (recommended) or all user roles
- Each user will be prompted to set up 2FA on their next login using an authenticator app such as Google Authenticator or Authy
- Scan the QR code with the authenticator app and enter the verification code to complete setup
|
❗ Important Enable 2FA for all Administrator accounts - this is the single most effective security improvement you can make to your WordPress site. An admin account with 2FA cannot be accessed even if the password is compromised. |
Step 4 - Change Your Login URL (Login Slug)
By default, all WordPress sites use /wp-login.php as the login URL. Hackers know this and target it specifically. Loginizer Pro lets you change the login URL to something custom and harder to guess.
- Go to Loginizer Security > Login Slug
- Enter a custom login path (e.g. /my-secure-login or any unique string)
- Click Save - your new login URL is now yourdomain.com/my-secure-login
- Bookmark the new URL and share it only with authorized users
|
⚠️ Warning If you forget your custom login URL, you can find it in the Loginizer settings via phpMyAdmin (in the wp_options table, look for the loginizer_slug option). Keep a record of your custom login URL in a secure location. |
Step 5 - Review the Login Logs
- Go to Loginizer Security > Logs
- Review the log of recent login attempts - you will see the IP address, username attempted, and the result (Success / Failed / Blocked)
- If you see many failed attempts from a specific IP, you can manually blacklist it under IP Management > Blacklist
Verify It Worked
- Go to Loginizer Security > Brute Force - settings are saved and brute force protection shows as Active
- Attempt to log in with a wrong password 3 times (using a different browser or incognito window) - after the max retries, the IP should be blocked and show a lockout message
- 2FA is enabled and users are prompted to enter a verification code on login
Related Articles
- How to Harden Your WordPress Site with WordPress Toolkit
- How to Update WordPress, Plugins, and Themes Safely (WordPress category)
- How SSL Certificates Work on Unisolva Hosting (AutoSSL)
