Control and protect WordPress access
Access Manager combines IP blacklist and whitelist controls, configurable failed-login limits, timed lockouts and a privacy-conscious login log in one dedicated WordPress administration screen.
- Blacklist or whitelist validated IPv4 and IPv6 addresses.
- Limit failed logins with configurable timed lockouts.
- Enable progressive lockout durations.
- Review successful, failed, blocked and locked events.
What does Access Manager do?
When the access_manager module is active, TOWP_Access_Manager checks login access by IP, records authentication events and applies failed-attempt lockouts. Administrators can maintain IPv4 and IPv6 blacklist and whitelist entries, configure the attempt threshold and lockout duration, enable progressive lockouts, inspect the capped event log, clear it and manually remove an IP lockout.
Every public login form attracts unwanted attempts
A standard WordPress login endpoint accepts repeated authentication attempts unless another control intervenes.
Repeated failures consume attention and resources
Automated login attempts can create noise, obscure legitimate events and repeatedly invoke the authentication process. Without a shared control panel, administrators often rely on scattered snippets, server rules or separate logging tools.
Blocking everyone is not practical
Trusted offices, maintenance systems or administrators may require predictable access. A usable solution must combine restrictions with explicit exemptions and provide enough event context to manage both safely.
Evaluate IP rules and limit repeated failures
The module uses native WordPress login and authentication hooks, a dedicated database table, non-autoloaded access lists and per-IP transients to coordinate enforcement and administration.
Block listed IP addresses
Blacklisted visitors are stopped on login_init with an HTTP 403 response before the login form is rendered.
Lock repeated failures
Failed attempts are counted in a hashed per-IP transient and blocked after the configured threshold is reached.
Manage activity centrally
A dedicated admin page exposes settings, blacklist, whitelist and login-log controls to authorized administrators.
Practical login controls in a single module
Every capability below is present in the supplied PHP class, admin view, JavaScript interface or activation routine.
IPv4 and IPv6 blacklist
Validated IP addresses can be stored with an optional label and blocked from the WordPress login page.
Trusted IP whitelist
Whitelisted addresses bypass failed-attempt counting and rate-limit lockouts.
Configurable attempt threshold
Administrators choose how many failed logins an IP may accumulate before a lockout applies.
Timed and progressive blocking
Set a base lockout duration and optionally increase later lockout cycles exponentially.
Login event log
Successful, failed, blacklisted and locked events are recorded with username, time, event type and hashed IP.
Protected AJAX management
Add or remove access-list entries, save settings, clear logs and remove lockouts through nonce-protected actions.
Where centralized access control helps most
The module supports sites that need clearer login visibility and direct IP-based controls without managing separate tools.
Business websites
Rate-limit repeated failed logins while keeping trusted office or administrator IP addresses exempt.
Managed client sites
Review authentication events and maintain access lists from one consistent TheOneWP screen.
Sites receiving brute-force traffic
Temporarily block IP hashes that exceed the configured threshold and permanently deny validated addresses when required.
Turn scattered login controls into a repeatable workflow
The module combines enforcement, exceptions, configuration and event review without changing WordPress users, roles or passwords.
REMOTE_ADDR instead of trusting spoofable forwarding headers.Focused checks with bounded storage
The verified implementation limits its interface assets to the Access Manager page and caps persistent login-event records.
Page-specific assets
The Access Manager stylesheet and script are enqueued only when the current admin hook contains the module page slug.
Non-autoloaded access lists
Blacklist and whitelist options are updated with autoload disabled, keeping them out of WordPress automatic option loading.
Batch lockout lookup
The admin log request collects unique hashes and queries matching transient options together rather than querying once per row.
Validated inputs and restricted administration
The code includes explicit capability checks, AJAX nonces, IP validation, sanitization and one-way hashing for login-log IP values.
Administrator-only controls
The page and AJAX handlers require manage_options, preventing ordinary users from managing access rules.
Nonce verification
Every administrative AJAX operation calls check_ajax_referer() with the Access Manager nonce.
Validated addresses
Blacklist, whitelist and unblock actions accept only values validated by FILTER_VALIDATE_IP for IPv4 or IPv6.
Privacy-conscious event logging
The log stores SHA-256 values salted with NONCE_SALT, while usernames and event types are sanitized before insertion.
Built around native WordPress authentication hooks
The supplied code integrates through APIs present in WordPress core. No compatibility claim beyond the verified implementation is assumed.
login_init
Blacklist and timed-lockout checks run on visits to the standard WordPress login page.
authenticate
Locked-out IPs receive a WP_Error before credential verification, including REST and XML-RPC authentication paths.
Core login actions
wp_login_failed records and counts failures, while wp_login records success and clears the counter.
TheOneWP versus common alternatives
Compare the verified Access Manager implementation with typical combinations of standalone plugins, custom snippets or manually maintained server rules.
| Capability | TheOneWP Access Manager | Other common solutions |
|---|---|---|
| IPv4 and IPv6 blacklist | Built-in validation, labels and management actions | Coverage and interface depend on the selected tool or rule set |
| Trusted-IP whitelist | Integrated exemption from rate limiting | May require a separate list, filter or server exception |
| Failed-login threshold | Configurable per-IP counter | May be fixed, separately configured or unavailable |
| Progressive lockout | Optional exponential duration increases | Behaviour varies by implementation |
| Authentication coverage | Login page plus REST and XML-RPC authentication lockout checks | Some approaches protect only wp-login.php |
| Login-event records | Success, failure, blocked and locked events with hashed IP values | Logging and privacy treatment vary |
| Administration | One TheOneWP page with protected AJAX controls | May require multiple plugins, files or hosting panels |
Configure and verify access protection in four steps
Test the rules from a safe session before relying on them in production.
Enable Access Manager
Activate the module and open its dedicated administration page from the configured menu position.
Set lockout rules
Choose the failed-attempt threshold, base duration and whether progressive lockouts should be enabled.
Define trusted and denied IPs
Add validated addresses to the whitelist or blacklist with optional notes for future administrators.
Test and review
Use a controlled IP to verify failed-login behaviour, then inspect the log and unblock it if necessary.
Protect access without locking out administrators
IP controls are effective only when access paths, proxies and recovery procedures are understood before deployment.
Confirm the observed IP
The module uses REMOTE_ADDR. Verify what WordPress receives when the site is behind a proxy, CDN or load balancer.
Start with a conservative threshold
Choose values that reduce automated retries without punishing legitimate password mistakes.
Keep a recovery path
Maintain safe administrative access before testing blacklist entries or aggressive lockout settings.
Review and clear stale data
Use labels for access-list context and periodically review the capped login log for meaningful patterns.
Avoid assumptions that weaken access management
The module has a defined scope and relies on the IP address WordPress receives from the server environment.
Ignoring reverse proxies
The code deliberately ignores X-Forwarded-For. A proxy setup must expose the correct visitor address through REMOTE_ADDR.
Blacklisting your own IP
A blacklisted address is stopped before the login form appears, so test access rules from a recoverable environment.
Expecting password or 2FA controls
Access Manager does not change passwords, enforce password policy or provide two-factor authentication.
Access Manager FAQ
These answers are derived from the verified class, admin view, activation logic and settings registration.
What does Access Manager do?
Access Manager protects WordPress authentication with an IPv4 and IPv6 blacklist, a whitelist exemption, failed-login rate limiting, optional progressive lockouts and a login-event log.
Which login paths are protected?
Blacklisted and locked-out IPs are checked on the normal WordPress login page. The authenticate filter also blocks locked-out IPs during authentication, covering authentication attempts made through XML-RPC and the REST API.
Can trusted IP addresses bypass rate limiting?
Yes. IP addresses added to the whitelist are exempt from the failed-attempt counter and lockout checks. The blacklist check still runs first on the login page.
Can I choose the number of failed attempts?
Yes. The settings page stores a configurable maximum-attempt value. The saved value is sanitized as an absolute integer and cannot be lower than one.
How long does a lockout last?
The base lockout duration is configurable in minutes and is stored as an absolute integer with a minimum value of one minute.
What does progressive lockout do?
When enabled, repeated lockout cycles increase the transient duration exponentially according to the stored lockout round.
Are IP addresses stored in the login log as plain text?
No. Login-event records store a SHA-256 hash generated from the IP address and NONCE_SALT. Blacklist and whitelist entries retain the actual validated IP because they are required for access enforcement.
How many login events are retained?
The custom access-log table is capped at 500 rows. After a new event is inserted, the oldest excess records are deleted.
Who can manage Access Manager?
The admin page and every AJAX operation require the manage_options capability. AJAX requests must also pass the module nonce.
Can an administrator clear the log or remove a lockout?
Yes. The interface includes protected AJAX actions to clear the complete login log and delete the transient associated with a validated IP address.
Control repeated login attempts.Keep trusted access manageable.
Use Access Manager to combine WordPress IP rules, configurable lockouts and login-event visibility inside one protected administration interface.