LyoGate A free WordPress login security plugin
The default WordPress login page is the first door every bot knocks on. LyoGate replaces it with a modern, protected one — a login page that looks like your brand and quietly stops brute-force attacks.
Why I built it
On every WordPress site I build, the login page gets hammered by automated attempts. The usual answer is a heavy security suite. I wanted something smaller: one plugin that protects the door and makes it look good, with no extra cookies and no tracking.
What it does
- Arithmetic captchaa simple sum before signing in, checked with an expiring, signed token (nothing stored in the database).
- Per-IP lockoutbrute force protection that limits login attempts: after 5 failed attempts an IP is blocked for 15 minutes (both configurable). A successful login resets the counter.
- Honeypota hidden field that catches bots.
- Same error for every failurewrong user and wrong password look identical, so usernames can't be guessed.
- Smaller attack surfaceXML-RPC off, no X-Pingback header, public REST user endpoints restricted, author archives redirected.
A login page that looks like your site
Title, subtitle, footer message, your logo with a link, two fonts and three colours — background, text and accent. Security doesn't have to look like a default form.
Clean by design
All settings live in a single database option. Uninstalling removes options and transients, multisite included. No extra cookies, no tracking.
FAQ
Is LyoGate free?
Yes. LyoGate is free and available on the official WordPress.org plugin directory.
Does LyoGate protect against brute-force attacks?
Yes. It combines an arithmetic captcha, a honeypot and a per-IP lockout: after 5 failed attempts (configurable) the IP is blocked for 15 minutes.
What does LyoGate need to run?
WordPress 6.0 or higher and PHP 8.0 or higher.