WP Manifestindependent plugin directory
manifest / security / login-failure-forensics

Login Failure Forensics

WordPress plugin that logs failed login attempts for support diagnostics

by Marija Lekić · github.com/lolifoks/login-failure-forensics

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/lolifoks/login-failure-forensics/archive/refs/heads/main.zip

Readme

Login Failure Forensics

A small WordPress plugin that captures failed login attempts with the reason, username, IP address, user agent, and timestamp. Adds an admin page under Login Failures in wp-admin so support staff can see the actual pattern instead of guessing.

Why

"Why can't I log in" is one of the most common WordPress support tickets, and the default WordPress log gives you almost nothing to work with. Was it a wrong password? A username that doesn't exist? An empty submission from a broken login form? A brute-force bot? Without data, every ticket is guesswork.

This plugin captures every failed login attempt with enough context to diagnose the real cause at a glance:

  • Wrong password for a real user → probably a forgotten password ticket
  • User does not exist across many random usernames → almost certainly a bot sweep
  • Empty username or password repeatedly → a broken form or a misconfigured client
  • A custom reason from a security plugin → tells you which plugin is doing the blocking

Features (v0.3.0)

  • Captures every failed login attempt
  • Records the specific WordPress error code as a human-readable reason
  • Captures username, IP address, user agent, and timestamp
  • Admin page under Login Failures in the sidebar (admin-only)
  • Paginated table showing full history, 25 attempts per page
  • Automatic schema migration between plugin versions

Requirements

  • WordPress 6.0+
  • PHP 7.4+

Installation

  1. Copy the plugin folder to wp-content/plugins/.
  2. Activate from the Plugins screen.
  3. Navigate to Login Failures in the admin sidebar.

What it captures

Column Details
Attempted username Whatever was typed in the username field
Failure reason The WordPress error code (incorrect_password, invalid_username, empty_username, etc.) mapped to a human label; unknown codes shown as-is
IP address From REMOTE_ADDR (v1); proxy-aware IP detection planned for a future version
User agent Truncated to 500 characters
Timestamp In the site's timezone

Security notes

  • All admin output escaped with esc_html
  • All input read from $_SERVER sanitized with sanitize_text_field and wp_unslash
  • All database queries with variables use $wpdb->prepare with typed placeholders
  • Admin page requires the manage_options capability at both menu registration and render time

Roadmap

  • IP-based grouping ("show me the 5 IPs with the most failures this week")
  • Filtering by reason, username, or date range
  • Optional auto-purge of records older than N days
  • Export to CSV

License

GPL-2.0-or-later

Read the full README on GitHub →