TOOL1 Firewall
Firewall & Login Protection by TOOL1 protects the front door of your WordPress site: the login page. It hides the login page from bots, blocks visitors who go looking for it, and stops password-guessing attacks. Everything runs on your own server, and no outside service is contacted.
Features
- Hide the login page. Replace
wp-login.phpwith an address of your choice, such as/my-login. Bots that trywp-login.phpor/wp-adminget a “not found” page instead. Password reset links keep working. - Block login page hunters. IP addresses that keep trying common login addresses (
/admin,/login,/dashboard,/administratorand any others you add) are blocked automatically. By default that’s 5 attempts within 60 minutes, and you can change both numbers. - Brute-force protection. After too many wrong passwords (5 by default), the IP address is blocked for an hour.
- Subnet blocking. When several addresses from the same network attack together, the whole network (C-class) is blocked for 24 hours. If it happens again, the block lasts 30 days.
- Search engines stay welcome. Visitors claiming to be Google, Bing or another major crawler are checked with a DNS lookup, and verified crawlers are never blocked.
- Login activity log. See successful and failed logins with the IP address, browser and time. Block or unblock an IP, a network or a user agent in one click.
- Works behind Cloudflare and proxies. Choose where the visitor’s real IP address comes from: a direct connection, Cloudflare, X-Forwarded-For or X-Real-IP. The settings page shows what your own browser sent, so you can pick the right option.
- Your own server is never blocked. Requests from the server itself, such as WP-Cron and loopback checks, are never blocked.
- Cleans up after itself. Expired blocks and old log entries are removed automatically once a day.
Pro add-on
A separate, paid add-on, Firewall & Login Protection Pro, is available from tool1.app. It adds:
- a firewall that blocks malicious requests and bad bots, with a POST rate limit and IP and user agent whitelists
- WordPress hardening for XML-RPC, the REST API, the version number, the file editor and more
- GeoIP country blocking
- bot visit analytics, a robots.txt editor and a security dashboard
The free plugin works fully on its own without it.