Nahnu Login and Form Shield

Hyperfocused login security. CAPTCHA, brute-force lockout, geo-blocking, 2FA, honeypot, and edge WAF — all from one screen. 100% free.

Description

Nahnu Login Shield does one thing and does it well: protect every WordPress login entry point. It is not a general security plugin. It is a login security plugin — hyperfocused on the login form, WooCommerce My Account, XML-RPC, the REST API, and all the form plugins your site might use.

No subscription. No license key. No upsell. Everything is included free.

Brute-force lockout

• Configurable attempt limit, time window, and short lockout duration.
• Escalating lockout — after N short lockouts the IP receives a long lockout (default 24 h).
• Per-username lockout — if the same username is tried from many different IPs (a distributed botnet), the username itself is locked across all IPs after a configurable threshold.
• Honeypot usernames — any attempt using a known-bad username (admin, root, administrator, test…) instantly locks the IP and the username globally. One attempt is enough.
• CIDR-supported IP blocklist and IP whitelist (IPv4 and IPv6).
• Manual unlock button next to any locked IP in the log.

Early blocking

When installed, the plugin automatically deploys a must-use plugin (mu-plugin) that fires before WordPress loads. Locked-out IPs are turned away at the door — no PHP framework, no database writes, no WooCommerce — for a fraction of the normal request cost. Honeypot IPs receive a full static block page for all site pages during the lockout period.

CAPTCHA / Verification providers

Choose one provider site-wide. The widget appears on every protected form automatically.

• OOPSpam — checkbox widget powered by OOPSpam Anti-Spam. Adds login-specific overrides: block VPN/proxy, datacenter IPs, and disposable email addresses.
• reCAPTCHA v2 — Google checkbox challenge.
• reCAPTCHA v3 — Google invisible score-based. No user interaction required.
• hCaptcha — privacy-first, free tier.
• Cloudflare Turnstile (managed) — Cloudflare decides whether to show a challenge based on risk signals.
• Cloudflare Turnstile (invisible) — entirely silent.
• Friendly Captcha — EU-hosted, proof-of-work, no cookies. GDPR-ready.
• None — disable the widget entirely. Geo-blocking, lockout, and honeypot still apply.

Two-factor authentication

• TOTP-based 2FA (Google Authenticator, Authy, 1Password, any TOTP app).
• Per-user setup from the WordPress profile page.
• Optional enforcement by user role — users who have not set up 2FA are allowed in but shown a persistent notice.
• QR code and manual secret key displayed during setup.

Geo-fencing

Reads the visitor country from CDN headers with zero latency and zero API quota. Supported headers: CF-IPCountry (Cloudflare), CDN-Country (Bunny.net), CloudFront-Viewer-Country (AWS CloudFront), X-Vercel-IP-Country (Vercel), X-Country-Code (Fastly/Akamai), X-Geo-Country (generic CDN).

Falls back to freeipapi.com, ip-api.com, or ipinfo.io (all free) with a configurable transient cache when no CDN header is present.

Edge WAF integration

• Bunny.net WAF — push locked-out IPs to Bunny WAF with one click. Blocks them at the CDN edge before they reach your server.
• Cloudflare WAF (IP Access Rules) — same for Cloudflare. Uses the IP Access Rules API (not the 5-rule WAF limit). Auto-expiry via WP-Cron.
• Both integrations support triggering on honeypot hits, on brute-force lockout, or both.
• Edge block log in the admin with IP, provider, reason, age, expiry, and one-click unblock.

JavaScript presence check

A hidden field filled by a small inline script gates every submission. Headless bots that skip JavaScript execution are blocked before CAPTCHA or lockout checks run — saving API quota.

Custom login URL

Optionally rename /wp-login.php to a secret path. Requests to the old URL return a configurable response: 404, redirect to home, or redirect to a custom URL.

REST API protection

• Block unauthenticated access to /wp-json/wp/v2/users (username enumeration).
• Apply lockout and IP block rules to REST API authentication.
• Optionally disable Application Passwords.

Session security

• Idle session timeout with configurable duration and a 2-minute warning dialog.
• Force logout all sessions immediately with one button (useful during an incident).

Login notifications

• Notify each user by email on account login with IP and device info.
• Alert admin emails whenever any administrator logs in.
• New-country alert: email the first time a user logs in from a previously unseen country.
• Weekly security digest: failed attempts, lockouts, honeypot hits, top attacking IPs, top targeted usernames.

WooCommerce My Account

Extend all protections — geo-blocking, lockout, honeypot, CAPTCHA, JS check — to the WooCommerce My Account login, registration, lost-password, checkout, and order-tracking forms. Each form has its own toggle.

Form plugin integrations

Apply CAPTCHA and JS verification to 43+ form plugins: Bricks Builder, SureForms, Contact Form 7, WPForms, Gravity Forms, Elementor Pro, Divi, Beaver Builder, Kadence Blocks, Spectra (UAG), Forminator, MetForm, Everest Forms, Formidable Forms, Ninja Forms, Fluent Forms, MemberPress, Paid Memberships Pro, Ultimate Member, BuddyPress, bbPress, WpDiscuz, WPForo, LearnDash, LearnPress, GiveWP, Easy Digital Downloads, Events Manager, and more.

Full event log

• Search by IP, username, or detail text.
• Filter by event type (fail, lockout, honeypot, geo block, success, captcha fail…).
• Date range picker.
• CSV export.
• Log detail column shows the source form or endpoint for every event (WooCommerce My Account, REST API, XML-RPC, Bricks Builder Form, WP Login form, etc.).
• Configurable retention period and row cap.

Analytics

• Daily activity chart (30-day view).
• Attack time-of-day heatmap.
• Event breakdown donut chart.
• Top attacking IPs table.
• Top targeted usernames table.
• All data is local — no external analytics service.

MainWP extension

A companion extension (Nahnu Login Shield — MainWP Extension) is available separately and allows site managers to view login shield data — lockouts, edge WAF blocks, recent events, settings summary — across all connected child sites from the MainWP dashboard, with a widget on each site overview page and a per-site detail tab.

Privacy

Nahnu Login Shield stores IP addresses and usernames in a local WordPress database table for the event log. The retention period and row cap are configurable. No data is sent to any Nahnu server. Third-party CAPTCHA providers and IP lookup services receive only the data required for their function, per their own privacy policies. Deleting the plugin removes all stored data via the included uninstall.php.

External services

The following third-party services are contacted only when explicitly configured by the site administrator:

• Google reCAPTCHA (v2/v3) — Privacy Policy · Terms. Server-to-server token verification on form submit.
• hCaptcha — Privacy Policy · Terms. Server-to-server token verification.
• Cloudflare Turnstile — Privacy Policy · Terms. Widget script on login page; server-to-server token verification.
• Friendly Captcha — Privacy Policy · Terms. Widget script from jsDelivr CDN; server-to-server verification.
• OOPSpam — Privacy Policy · Terms. IP reputation check on submit. Requires OOPSpam Anti-Spam plugin with API key.
• Bunny.net WAF API — Privacy Policy. Called when Bunny WAF integration is enabled and a lockout/honeypot event fires. Sends only the blocked IP address.
• Cloudflare WAF API — Privacy Policy. Called when Cloudflare WAF integration is enabled. Sends only the blocked IP address.
• freeipapi.com — Geo-lookup fallback. https://free.freeipapi.com/api/json/{ip}. Free tier. Privacy Policy.
• ip-api.com — Geo-lookup fallback. http://ip-api.com/json/{ip}. Free non-commercial tier. Privacy Policy.
• ipinfo.io — Geo-lookup fallback. https://api.ipinfo.io/lite/{ip}. Free Lite API. Privacy Policy.
• Chart.js (cdnjs.cloudflare.com) — Loaded on the Analytics admin tab only. No user data sent. MIT-licensed.

None of these services are contacted unless you have selected them in plugin settings.

Installation

1. Upload the nahnu-login-shield folder to /wp-content/plugins/.
2. Activate through Plugins in the WordPress admin.
3. Go to Settings > Login Shield to configure.

Quick start:

1. On the Widget tab, choose a CAPTCHA provider (or leave it as None to use lockout only).
2. On the Lockout tab, review the attempt thresholds.
3. On the Geo tab, enable geo-blocking and select blocked countries if needed.
4. On the Integrations tab, enable protections for any form plugins you use.
5. On the Edge Blocking tab, connect your Bunny.net or Cloudflare account to push blocks to the edge.

To use OOPSpam, install and activate the OOPSpam Anti-Spam plugin and enter your API key there first. Nahnu Login Shield detects it automatically.

Frequently Asked Questions

Do I need OOPSpam installed?

No. OOPSpam is one of seven CAPTCHA provider options. All other providers and all other features work independently.

Does this plugin slow down my site?

No. Assets load only on wp-login.php and any pages you opt into via the Integrations tab. The JS check uses a tiny inline script with no external request. Geo lookups from CDN headers are zero-latency. API fallback results are cached per IP for a configurable period. The mu-plugin turns away locked-out IPs before WordPress loads.

What happens if the CAPTCHA API goes down?

All providers fail open. A network or API error never locks out legitimate users.

Will this conflict with other security plugins?

It hooks specifically into WordPress login actions and standard WooCommerce and form-plugin hooks. If another plugin hooks the same actions it may conflict. Open a support thread with details if you see an issue.

Can I use this without any CAPTCHA?

Yes. Set the provider to None. Geo-blocking, brute-force lockout, honeypot username trapping, the JS presence check, and 2FA all work independently of CAPTCHA.

Does it work with WooCommerce?

Yes. The WooCommerce My Account login, registration, lost-password, checkout, and order-tracking forms each have their own toggle in the WooCommerce section of the Integrations tab.

I locked myself out. How do I get back in?

Two options. First, rename the plugin folder from nahnu-login-shield to _nahnu-login-shield via SFTP, which deactivates it. Second, add define( 'NLS_BYPASS_IP', 'your.ip.address' ); to wp-config.php to bypass lockouts for your IP without deactivating.

Is this compatible with multisite?

It is not tested on multisite and is not recommended for network activation.

How does geo-blocking work when I do not use a CDN?

It falls back to one of three free IP geolocation APIs (freeipapi.com, ip-api.com, ipinfo.io) with a configurable cache. CDN headers are always checked first and take priority.

How do I get a new form plugin supported?

Open a support thread or use the contact form on nahnuloginshield.com. We support as many plugins as we can for free.

What is the mu-plugin and is it safe to have?

During activation Nahnu Login Shield copies nls-early-block.php to wp-content/mu-plugins/. This file checks whether the requesting IP is locked out and, if so, sends a 403 response before WordPress loads — dramatically reducing server load during bot floods. It is removed automatically on plugin deactivation.

Can attackers bypass the lockout by rotating IPs?

The per-username lockout catches this: if the same username is attempted from too many different IPs within the time window, the username itself is locked regardless of IP. Adding common targets (admin, administrator, root) to the Honeypot username list gives the strongest protection — one attempt from any IP is enough to lock both the IP and the username globally.

Screenshots

1. General tab — master controls, REST API protection, and session settings.
2. Widget tab — CAPTCHA provider selection cards and live preview.
3. Geo tab — country detection source and blocklist picker.
4. Lockout tab — attempt thresholds, active lockouts, and blocked IPs.
5. Edge Blocking tab — Bunny.net and Cloudflare WAF integration with block log.
6. Log tab — full event log with search, filter, date range, and CSV export.
7. Analytics tab — daily chart, heatmap, top IPs, and top usernames.
8. Integrations tab — form plugin cards.
9. Login page — OOPSpam widget rendered before the submit button.

Changelog

1.0.0

• Initial public release.
• Brute-force lockout with escalation, per-username lockout, and honeypot usernames.
• CAPTCHA providers: OOPSpam, reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile (managed/invisible), Friendly Captcha.
• Two-factor authentication (TOTP) with per-role enforcement.
• Geo-blocking via CDN headers (Cloudflare, Bunny, CloudFront, Vercel, Fastly) with IP API fallback.
• Edge WAF integration for Bunny.net and Cloudflare with auto-expiry and block log.
• JavaScript presence check.
• Custom login URL with configurable 404/redirect behaviour.
• REST API protection: username enumeration block, lockout enforcement, Application Password toggle.
• Session security: idle timeout with warning dialog, force-logout all sessions.
• Login notifications: per-login email, admin alerts, new-country alerts, weekly digest.
• WooCommerce My Account integration: login, registration, lost-password, checkout, order tracking.
• Full event log with search, filter, date range, CSV export, and source-form detail column.
• Analytics: daily chart, time-of-day heatmap, event breakdown, top IPs, top usernames.
• Early-block mu-plugin: locked-out IPs blocked before WordPress loads.
• APCu support for attempt counters (100x faster than DB transients on supported hosts).
• MainWP extension companion plugin available separately.

Upgrade Notice

1.0.0

Initial public release. No upgrade path from pre-release builds.