A Smarter, Safer Way to Log In to WordPress.
Protect WordPress with passwordless Email OTP authentication, brute-force protection, IP controls, security logs, REST API protection and more.
- ✓Login attempt detected
- ✓OTP verification requested
- ✓User verified ✓
- ✓Secure token generated ✓
- ✓Login successful
Fewer Steps. No Password to Lose.
Traditional password
- 1Password requiredtype…
- 2Forgot passwordstuck
- 3Reset emailwaiting
- 4New passwordagain
- 5Loginfinally
Authyo passwordless
- 1Emailinstant
- 2OTPone code
- 3Verifyseconds
- 4Secure Tokensingle-use
- 5Logged In ✓done
Six Layers Around Your WordPress.
Watch each protection layer activate around your site.
PRESS
See Threats. Block Them Before They Become Problems.
Illustrative feed — IP addresses are masked.
Manage Every Address, Your Way.
Whitelist, blacklist and review IPs with search, filtering and pagination. Hover a row for actions.
Every Event, on the Record.
Logins, logouts, failed attempts, lockouts and blocked access — filter the timeline as it fills in real time.
From Email to Dashboard in Five Steps.
An Extra Layer When You Need It.
Google Authenticator can act as a server-side verified backup method after multiple OTP attempts. Email OTP and the fallback require Authyo API credentials.
- Email OTPThe user requests a login code
- Multiple failed OTP attemptsThe code can’t be verified
- Google AuthenticatorFallback method takes over
- 6-digit verificationCode from the authenticator app
- Access Granted ✓The user is signed in
Hide wp-login.php in Plain Sight.
/secure-login/Close the Side Doors, Keep the Real Ones Open.
XML-RPC
Server-level blocking where supported, with a PHP fallback on Nginx.
REST API
Unauthenticated access is restricted; authenticated access carries on normally.
Core Security Works Without API Keys.
Security protection
- Brute-force protection
- IP Manager
- Security logs
- XML-RPC protection
- REST API protection
- Custom login URL
Passwordless authentication
- Email OTP
- Google Authenticator fallback
Local Protection, External Authentication.
Everything in One Admin Menu.
Click through the plugin’s admin screens (illustrative).
Secure Logins, Wherever People Sign In.
Eleven Boxes, All Checked.
Questions, Answered.
How does passwordless login work?
Enter your email, receive a one-time password by email, verify the code, and Authyo signs you in with a secure token. There is no password to create, remember or reset.
Do I need Authyo API keys for security protection?
No. Brute-force protection, the IP Manager, security logs, XML-RPC protection, REST API protection and the custom login URL all work locally after activation.
Which features work without API keys?
Brute-force protection with progressive lockouts, the IP Manager, security activity logs, XML-RPC blocking, REST API protection and the custom login URL.
How does Email OTP login work?
Visitors request a code by email and enter it to log in. This requires Authyo API credentials. Rate limits apply: each session allows 5 attempts, accounts are limited to 10 attempts per 15 minutes and 30 per day, and an email address can request up to 5 OTPs per 15 minutes.
What is the Google Authenticator fallback?
A server-side verified 2FA method that acts as a backup after multiple OTP attempts. It requires Authyo API credentials, and the admin email is sent to Authyo during setup to generate the QR code.
How does brute-force protection work?
It limits login attempts per IP address and username with progressive lockout durations, and repeat offenders are automatically blacklisted.
Can I manage blocked IP addresses?
Yes. The IP Manager lets you whitelist and blacklist addresses, with search, filtering, pagination and a per-page selector.
Does Authyo protect XML-RPC?
Yes. It blocks XML-RPC at the server level (.htaccess on Apache and LiteSpeed) with a PHP fallback on Nginx, and removes X-Pingback headers and discovery links.
Does Authyo protect the WordPress REST API?
Yes. It restricts REST API access for unauthenticated users.
Can I create a custom login URL?
Yes. You can hide wp-login.php behind a custom URL slug.
Can I use Authyo on a custom login page?
Yes. Login is AJAX-powered with no page reloads, and you can place it anywhere with the [authyo_login] shortcode or the authyo_passwordless_login_form() function.
How are login tokens protected?
Tokens are cryptographically generated, single-use and browser-bound (using a hashed User-Agent signature), and they expire after 5 minutes.
Replace Password Friction With Smarter WordPress Security.
Protect your WordPress login with passwordless authentication and multiple security layers.
Email OTP login and the Google Authenticator fallback require Authyo API credentials; the security features work without them. User email addresses are sent to Authyo to request and verify OTPs, and the admin email is sent during Google Authenticator setup. Requires WordPress 5.0+ and PHP 7.2+. Interactive demos on this page are simulations with masked, illustrative data.