Title: SentriLog – Limit Login Attempts, Security & Activity Log Author: Rayhan Uddin Published: 2026년 9월 2일 Last modified: 2026년 9월 18일 --- 플러그인 검색 ![](https://ps.w.org/sentrilog/assets/banner-772x250.png?rev=3678792) ![](https://ps.w.org/sentrilog/assets/icon.svg?rev=3678792) # SentriLog – Limit Login Attempts, Security & Activity Log 작성자: [Rayhan Uddin](https://profiles.wordpress.org/rayetun/) [다운로드](https://downloads.wordpress.org/plugin/sentrilog.1.2.0.zip) * [세부사항](https://ko.wordpress.org/plugins/sentrilog/#description) * [평가](https://ko.wordpress.org/plugins/sentrilog/#reviews) * [설치](https://ko.wordpress.org/plugins/sentrilog/#installation) * [개발](https://ko.wordpress.org/plugins/sentrilog/#developers) [지원](https://wordpress.org/support/plugin/sentrilog/) ## 설명 🛡️ **SentriLog** is the free way to **stop brute-force attacks** on your WordPress login and **see exactly what is happening** at your front door. Install, activate, and you’re protected — smart per-IP lockouts, a full authentication activity log, login hardening, and instant email alerts, all with **zero configuration required**. Most attacks on WordPress start at `wp-login.php`: bots hammer it with thousands of username and password guesses. SentriLog counts every failed attempt, locks out offenders automatically, records the whole story, and lets you move the login page somewhere bots can’t find it. **Everything runs on your own site by default.** SentriLog makes **no external HTTP requests** out of the box — every lockout, log entry, and setting stays in your own WordPress database. No account, no tracking. The one optional exception is the CAPTCHA integration (Google reCAPTCHA or Cloudflare Turnstile), which stays off until you add your own keys (fully disclosed under External Services below). #### How SentriLog is built * ⚡ **Zero-config**: protection and logging start the moment you activate — sensible defaults, nothing to set up * 🔒 **Privacy-first**: no data collection and no phone-home; no external calls at all unless you switch on the optional CAPTCHA (reCAPTCHA or Turnstile) * 🪶 **Lightweight**: bot detection runs only on login/authentication events, so normal visitors are never slowed down * 🧩 **Works with any login form**: hooks WordPress core auth (`authenticate`, ` wp_login_failed`, `wp_login`), so WooCommerce, membership, and custom login forms are all covered * 🌐 **Multisite compatible**: activate per-site or network-wide, each site with its own settings and log #### ⚡ Smart Brute-Force Protection Lock out attackers automatically, without locking out your real users. * 🔢 **Limit login attempts** — lock an IP after a configurable number of failed tries within a rolling time window * 📈 **Progressive lockout escalation** — repeat offenders are locked out for longer, automatically * 👥 **Per-IP + username tracking** — attempts are counted per IP and username pair, so one attacker can’t lock out everyone * 🧮 **Remaining-attempts hint** — optionally tell users how many tries remain before a lockout * 🧷 **XML-RPC protection** — detects and blocks `system.multicall` brute-force patterns * 🗂️ **Lockout manager** — view every active lockout with a live countdown, and clear one or all in a click #### 📋 Full Activity Log & Audit Trail Know who tried to get in, from where, and when. * 📝 **Every event recorded** — login successes, failures, logouts, lockouts, and password events, each with IP address, username, user-agent, and timestamp * 🔍 **Filter and search** — narrow the log by event type, username, IP, or date range * ⬇️ **CSV export** — download the activity log (respecting your current filters) for audits or spreadsheets * 🧹 **Retention & auto-cleanup** — set how long logs are kept (90 days by default); old records are pruned automatically via WP-Cron #### 🔑 Access Control **🚪 Change Login URL** Move `wp-login.php` to a secret slug of your choice and block the default endpoint, so automated attacks never even find the login form. A built-in emergency recovery link means you can never be permanently locked out. **🪄 Magic Login** Generate temporary, single-use, passwordless login links for support staff or clients. The temporary user is created on demand and removed automatically the moment the link expires or is revoked — no lingering accounts. **⏲️ Idle Session Timeout** Automatically sign out inactive users after a period you choose, so an unattended browser doesn’t become an open door. #### 🔐 Two-Factor Authentication Add a second layer to any account — no external service, no account required. * 📱 **Authenticator app (TOTP)** — works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any standard TOTP app * 🔳 **Local QR code** — the setup QR is drawn in your browser, so the shared secret never leaves your site * 🔑 **Backup codes** — single-use recovery codes for when you don’t have your device * 🔒 **Encrypted at rest** — the 2FA secret is encrypted in the database, so a stray database dump can’t expose it * 👤 **Opt-in per user** — each user turns it on from their own profile screen #### 🧱 Login Hardening * 🙈 **Username enumeration protection** — normalize login error messages, block`? author=N` and author-archive scans, and lock down the REST API users endpoint so attackers can’t harvest valid usernames * 🌐 **Configurable IP source** — choose exactly how visitor IPs are detected ( direct connection, Cloudflare, reverse proxy, or load balancer) so a spoofed header can’t defeat your lockouts * 🧷 **XML-RPC multicall blocking** — shut down a common amplification vector for password guessing #### 🤖 CAPTCHA (optional) Add a CAPTCHA to your login, lost-password, and registration forms to stop bots before they ever reach your credentials. **Off by default** — bring your own free keys to switch it on. * 🛡️ **Choose your provider** — Google reCAPTCHA or **Cloudflare Turnstile**, a privacy-first challenge that does not track users * 🧩 **reCAPTCHA v3 (invisible) or v2 (checkbox)** — v3 scores requests silently; v2 shows the classic “I’m not a robot” checkbox * 🎯 **Adjustable score threshold** for reCAPTCHA v3 — tune how strict the bot filter is * 🗂️ **Per-form control** — protect the login, lost-password, and/or registration forms independently * 🔐 **Verified server-side** with your secret key; fails open during a provider outage so you’re never locked out CAPTCHA is the only part of SentriLog that contacts an external service — see the** External Services** section for the full data disclosure. #### 🔔 Alerts & Dashboard * ✉️ **Email alerts** — get notified after a configurable number of consecutive failures, and whenever a lockout is triggered * 📊 **At-a-glance dashboard** — logins, failures, and lockouts over the last 24 hours and 7 days, with a 7-day trend chart (Chart.js, bundled locally — no external requests) * 🌗 **Light & dark mode** — a clean, modern admin UI with a one-click theme toggle; light by default * 🧰 **Tabbed settings** — Lockout, Security, Logging, and Notifications, each with sensible defaults #### 🔒 Privacy First SentriLog is built to protect your users’ privacy as well as your site: * Makes **no external HTTP requests by default** — the only feature that contacts an outside service is the optional CAPTCHA (Google reCAPTCHA or Cloudflare Turnstile), which stays off until you enable it (see External Services) * Stores data **only in your own database** to enforce lockouts and provide an audit trail * Cleans up completely on uninstall — drops its tables, deletes its options, removes any temporary Magic Login users, and clears its scheduled events * A `rayetun_lsn_anonymise_ip` filter is available if you want to anonymize stored IP addresses #### 👩‍💻 For Developers SentriLog is built on WordPress standards and exposes hooks so you can extend it: * `rayetun_login_sentinel_event_logged( $event_type, $user_id, $username, $ip, $extra_data )` — fires after every logged event * `rayetun_login_sentinel_lockout_triggered( $ip, $username, $duration, $attempt_count)`— fires when an IP is locked out * `rayetun_login_sentinel_should_lockout( $should_check, $ip, $username )` — short- circuit the lockout check (e.g. for an allowlist) * `rayetun_lsn_anonymise_ip` — filter stored IP addresses for anonymization * `rayetun_login_sentinel_2fa_verified( $user_id )` — fires after a user passes two-factor verification ### Upgrade to SentriLog Pro SentriLog is fully functional on its own — Pro is an optional upgrade for teams and agencies that want more. It adds, among other things: * Advanced two-factor authentication — passkeys / WebAuthn (Face ID, Touch ID, security keys), email OTP, trusted-device bypass, and per-role enforcement * IP allowlist & blocklist with CIDR ranges, plus country blocking with separate block and allow lists * Breached-password protection (Have I Been Pwned) and login anomaly detection ( impossible travel + new device) * File integrity monitoring, threat-intelligence IP reputation, and business-hours admin access * Slack, Discord & webhook alert routing, self-service lockout recovery, and a weekly security digest * Agency tools — a multisite network dashboard, settings export/import & sync, and white-labeled client PDF reports Every plan includes a 14-day free trial. Open **SentriLog Go Pro** in your dashboard for the full list and pricing. ### External Services SentriLog is self-contained and, by default, makes no external requests. Its optional CAPTCHA feature can use **one** of two third-party providers, both **disabled by default** and used only if you choose to turn one on. You pick the provider and supply your own keys. #### Google reCAPTCHA If you select Google reCAPTCHA under **SentriLog Settings CAPTCHA** and enter your own keys, SentriLog protects the login, lost-password, and/or registration forms you select with Google reCAPTCHA, a bot-detection service provided by Google. * **When it runs:** only on the forms you choose to protect, and only while reCAPTCHA is enabled with valid keys. Visitors’ browsers load the reCAPTCHA script from Google, and when a protected form is submitted the reCAPTCHA token and the visitor’s IP address are sent to Google to confirm the request is human. * **Data sent:** the reCAPTCHA response token and the visitor’s IP address. No other personal data is transmitted, and nothing is sent when reCAPTCHA is disabled. * **Endpoints:** the script is loaded from `https://www.google.com/recaptcha/api. js` and tokens are verified at `https://www.google.com/recaptcha/api/siteverify`. * **Terms:** use of Google reCAPTCHA is subject to Google’s [Terms of Service](https://policies.google.com/terms) and [Privacy Policy](https://policies.google.com/privacy). #### Cloudflare Turnstile If you select Cloudflare Turnstile under **SentriLog Settings CAPTCHA** and enter your own keys, SentriLog protects the forms you select with Cloudflare Turnstile, a privacy-first bot-detection service provided by Cloudflare that does not track users or serve interactive image challenges. * **When it runs:** only on the forms you choose to protect, and only while Turnstile is enabled with valid keys. Visitors’ browsers load the Turnstile script from Cloudflare, and when a protected form is submitted the Turnstile token and the visitor’s IP address are sent to Cloudflare to confirm the request is human. * **Data sent:** the Turnstile response token and the visitor’s IP address. No other personal data is transmitted, and nothing is sent when Turnstile is disabled. * **Endpoints:** the script is loaded from `https://challenges.cloudflare.com/turnstile/ v0/api.js` and tokens are verified at `https://challenges.cloudflare.com/turnstile/ v0/siteverify`. * **Terms:** use of Cloudflare Turnstile is subject to Cloudflare’s [Website Terms of Use](https://www.cloudflare.com/website-terms/) and [Privacy Policy](https://www.cloudflare.com/privacypolicy/). If you never enable CAPTCHA, SentriLog makes no external requests at all. ### Credits SentriLog is built and maintained by [Md Rayhan Uddin](https://rayetun.com/). This plugin bundles the following open-source library, served locally from the plugin— no external requests are made to load it: * **Chart.js** v4.5.1 — used to render the dashboard trend chart. Copyright (c) Chart.js Contributors, [MIT License](https://github.com/chartjs/Chart.js/blob/master/LICENSE.md). Project: https://www.chartjs.org Thank you to the WordPress community and to everyone who reports issues and suggests features on the [support forum](https://wordpress.org/support/plugin/sentrilog/). ## 스크린샷 [⌊Dashboard — at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart.⌉⌊Dashboard — at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart.⌉[ Dashboard — at-a-glance stats for logins, failures, and lockouts over 24 hours and 7 days, with a 7-day trend chart. [⌊Activity Log — filterable, badge-coded table of every authentication event with IP, username, and timestamp.⌉⌊Activity Log — filterable, badge-coded table of every authentication event with IP, username, and timestamp.⌉[ Activity Log — filterable, badge-coded table of every authentication event with IP, username, and timestamp. [⌊Lockouts Manager — view active lockouts with live countdown timers and clear them individually or all at once.⌉⌊Lockouts Manager — view active lockouts with live countdown timers and clear them individually or all at once.⌉[ Lockouts Manager — view active lockouts with live countdown timers and clear them individually or all at once. [⌊Settings — Lockout: configure attempt limits, time window, lockout duration, and progressive escalation.⌉⌊Settings — Lockout: configure attempt limits, time window, lockout duration, and progressive escalation.⌉[ Settings — Lockout: configure attempt limits, time window, lockout duration, and progressive escalation. [⌊Settings — Security: change the login URL, harden against username enumeration, and set the client IP source.⌉⌊Settings — Security: change the login URL, harden against username enumeration, and set the client IP source.⌉[ Settings — Security: change the login URL, harden against username enumeration, and set the client IP source. [⌊Settings — Notifications: choose the alert email and the conditions that trigger it.⌉⌊Settings — Notifications: choose the alert email and the conditions that trigger it.⌉[ Settings — Notifications: choose the alert email and the conditions that trigger it. [⌊Magic Login — generate temporary, single-use, passwordless login links.⌉⌊Magic Login — generate temporary, single-use, passwordless login links.⌉[ Magic Login — generate temporary, single-use, passwordless login links. ## 설치 1. Upload the `sentrilog` folder to `/wp-content/plugins/`, or install directly through** Plugins Add New**. 2. Activate the plugin through the **Plugins** screen in WordPress. 3. Go to **SentriLog Dashboard** to watch your login activity in real time. No configuration is required to get started — SentriLog begins limiting login attempts and logging events immediately after activation. Fine-tune attempt limits, hardening, and email alerts any time under **SentriLog Settings**. ## FAQ ### ❓ Will this plugin lock me out of my own site? It can, if you enter the wrong credentials too many times. If it happens, you have three easy ways back in: use the **Change Login URL** emergency recovery link, temporarily deactivate the plugin by renaming its folder over FTP/SSH, or remove the lockout in your database with `DELETE FROM wp_rayetun_lsn_lockouts WHERE ip_address = 'YOUR_IP';`. ### 🌐 Does it make any external requests or send my data anywhere? By default, no — SentriLog makes **zero external HTTP requests** and stores everything in your own WordPress database. The dashboard chart uses **Chart.js**, bundled locally( MIT licensed) — no CDN. The one exception is the **optional CAPTCHA** integration: it stays off until you add your own Google reCAPTCHA or Cloudflare Turnstile keys, and when enabled it verifies protected form submissions with your chosen provider. See the External Services section below for exactly what is sent. ### 🔌 Does it work with WooCommerce, membership plugins, or custom login forms? Yes. SentriLog hooks WordPress core authentication filters (`authenticate`, `wp_login_failed`,` wp_login`), which fire no matter which login form is used — WooCommerce, BuddyPress, membership plugins, and custom forms are all protected. ### 🕵️ Can I hide my login page? Yes. The **Change Login URL** feature moves `wp-login.php` to a secret slug you choose and blocks the default endpoint, so bots can’t find the form. An emergency recovery link makes sure you can always get back in. ### 🪄 What is Magic Login? Magic Login creates a temporary, single-use, passwordless login link you can hand to support staff or a client. The temporary user is removed automatically when the link expires or you revoke it — no leftover accounts. ### 🔐 How do I turn on two-factor authentication? Go to **Users Profile** and scroll to the **Two-Factor Authentication** section. Scan the QR code with any authenticator app, enter the 6-digit code to confirm, and save your profile. You’ll be shown a set of backup codes once — store them somewhere safe. From then on, you’ll enter a code from your app each time you log in. To turn it off, tick “Disable two-factor authentication” on the same screen and save. (Trusted devices, email codes, and requiring 2FA for whole roles are available in the Pro add-on.) ### 🛡️ Does it protect XML-RPC? Yes. SentriLog detects `system.multicall` brute-force patterns and blocks that request, closing a common password-guessing amplification vector. ### 📜 Is it GDPR-friendly? SentriLog stores IP addresses in your own database to enforce lockouts and keep an audit trail — IP addresses can be personal data, so you should disclose this in your site’s privacy policy. Nothing is ever transmitted to us, logs are auto- deleted after your chosen retention period, and a `rayetun_lsn_anonymise_ip` filter is available if you want to anonymize stored IPs. If you enable the optional CAPTCHA, visitor IPs are also sent to your chosen provider (Google or Cloudflare) for verification— see External Services below. ### 🤖 How do I enable CAPTCHA, and is it required? It’s completely optional and off by default. To turn it on, go to **SentriLog Settings CAPTCHA**, pick a provider — Google reCAPTCHA ([get keys](https://www.google.com/recaptcha/admin)) or Cloudflare Turnstile ([get keys](https://dash.cloudflare.com/?to=/:account/turnstile))— paste your Site Key and Secret Key, choose which forms to protect, and save. Until you add your keys, CAPTCHA does nothing and no data is sent anywhere. See the External Services section for exactly what is shared. ### 📤 Can I export the activity log? Yes. Export the activity log to CSV directly from the **Activity Log** screen, respecting whatever filters you have applied. ### 🌍 Does it work on WordPress Multisite? Yes. When network-activated, SentriLog creates its tables for each sub-site, and each site keeps its own independent settings and log. ### ♻️ What happens when I uninstall? Everything is cleaned up: all custom tables are dropped, plugin options are deleted, any temporary Magic Login users are removed, and scheduled events are cleared. Nothing is left behind. ### 💬 Get support Post in the [WordPress.org support forum](https://wordpress.org/support/plugin/sentrilog/). We aim to respond within 24 hours on business days. ## 후기 이 플러그인에 대한 평가가 없습니다. ## 기여자 & 개발자 “SentriLog – Limit Login Attempts, Security & Activity Log”(은)는 오픈 소스 소프트웨어입니다. 다음의 사람들이 이 플러그인에 기여하였습니다. 기여자 * [ Rayhan Uddin ](https://profiles.wordpress.org/rayetun/) [자국어로 “SentriLog – Limit Login Attempts, Security & Activity Log”(을)를 번역하세요.](https://translate.wordpress.org/projects/wp-plugins/sentrilog) ### 개발에 관심이 있으십니까? [코드 탐색하기](https://plugins.trac.wordpress.org/browser/sentrilog/)는, [SVN 저장소](https://plugins.svn.wordpress.org/sentrilog/) 를 확인하시거나, [개발 기록](https://plugins.trac.wordpress.org/log/sentrilog/)을 [RSS](https://plugins.trac.wordpress.org/log/sentrilog/?limit=100&mode=stop_on_copy&format=rss) 로 구독하세요. ## 변경이력 #### 1.2.0 * New: Cloudflare Turnstile is now a CAPTCHA option alongside Google reCAPTCHA — a privacy-first challenge that does not track visitors. Pick your provider under Settings CAPTCHA and bring your own free keys. * The reCAPTCHA settings tab is now a unified “CAPTCHA” tab; your existing reCAPTCHA keys and settings are preserved. * The External Services section now documents Cloudflare Turnstile (endpoints, data sent, terms). #### 1.1.0 * New: Optional Google reCAPTCHA (v3 invisible or v2 checkbox) on the login, lost- password, and registration forms, with per-form toggles and an adjustable v3 score threshold. Off by default — bring your own free Google keys. * reCAPTCHA is the plugin’s only external service and is fully disclosed in the new “External Services” section; it sends data to Google only when you enable it. * New: SentriLog Pro is now available — an optional premium upgrade adding advanced 2FA & passkeys, IP/country rules, anomaly detection, alert routing, and agency tools. The free plugin stays fully functional; see SentriLog Go Pro. #### 1.0.1 * New: Two-Factor Authentication — app-based TOTP (Google Authenticator, Authy, and any standard app) with a locally generated QR code and single-use backup codes, enabled per user from the profile screen. * The 2FA secret is encrypted at rest (libsodium); the QR is rendered in the browser, so nothing is sent to any third party. #### 🎉 1.0.0 * Initial release. * Limit login attempts with configurable max attempts, rolling time window, and lockout duration. * Progressive lockout escalation for repeat offenders, tracked per IP + username. * Full authentication activity log (logins, failures, logouts, lockouts, password events) with filtering and CSV export. * Change Login URL — hide wp-login.php behind a custom slug with an emergency recovery link. * Magic Login — temporary, single-use, passwordless login links that clean themselves up. * Username enumeration protection — login error normalization, author-scan blocking, and REST API users lockdown. * Idle session timeout with a JavaScript heartbeat. * Configurable client IP source (direct, Cloudflare, reverse proxy, load balancer) to prevent header spoofing. * XML-RPC system.multicall brute-force protection. * Email alerts on repeated failures and on lockout. * Admin dashboard with stats, a 7-day trend chart (Chart.js, bundled locally), the activity log, and the lockout manager. * Light and dark admin theme with a one-click toggle. * Tabbed settings: Lockout, Security, Logging, Notifications. * WP-Cron–powered log retention and expired-lockout cleanup. * WordPress Multisite compatible. * Makes no external requests and collects no data — everything stays in your database. * Full internationalization support via the bundled `.pot` file. ## 기초 * 버전 **1.2.0** * 최근 업데이트: **6일 전** * 활성화된 설치 **10보다 적음** * 워드프레스 버전 ** 6.0 또는 그 이상 ** * 다음까지 시험됨: **7.1.2** * PHP 버전 ** 8.0 또는 그 이상 ** * 언어 * [English (US)](https://wordpress.org/plugins/sentrilog/) * 태그: * [Activity Log](https://ko.wordpress.org/plugins/tags/activity-log/)[Brute Force](https://ko.wordpress.org/plugins/tags/brute-force/) [hide login url](https://ko.wordpress.org/plugins/tags/hide-login-url/)[limit login attempts](https://ko.wordpress.org/plugins/tags/limit-login-attempts/) [login security](https://ko.wordpress.org/plugins/tags/login-security/) * [고급 보기](https://ko.wordpress.org/plugins/sentrilog/advanced/) ## 평점 아직 제출된 리뷰가 없습니다. [Your review](https://wordpress.org/support/plugin/sentrilog/reviews/#new-post) [모든 리뷰 보기](https://wordpress.org/support/plugin/sentrilog/reviews/) ## 기여자 * [ Rayhan Uddin ](https://profiles.wordpress.org/rayetun/) ## 지원 할 말 있으신가요? 도움이 필요하신가요? [지원 포럼 보기](https://wordpress.org/support/plugin/sentrilog/) ## 기부 이 플러그인이 발전하도록 도우시겠습니까? [ 이 플러그인에 기부하기 ](https://wise.com/pay/me/mdrayhanu2)