WordPress login security
The big security suites guard the whole house lightly. The hide-login plugins only change the lock's address. Silverback Login owns the front door — hidden URL, email 2FA, breach screening, reuse prevention, forced rotation, inactive account lock. Correct by default, two settings screens, no bloat.
Why we built this
The big suites — Wordfence, Defender, iThemes, All-In-One Security — bundle firewalls, malware scans, and dozens of other modules. Login security is one feature in a large box. Powerful, but heavy, complex, and generic on the part that matters most.
The hide-login plugins — WPS Hide Login and its neighbors — do exactly one thing: change the login URL. That reduces bot noise, but it's not real security. A leaked password still gets in.
Nobody owns the middle. That's the lane Silverback Login lives in: a specialist that does the front door exceptionally well. Hidden URL to cut down scanner traffic. Email 2FA to catch stolen passwords. Breach screening, reuse prevention, and forced rotation to keep the passwords themselves honest. Every piece coordinated, none of it bloat.
What it does
Each module targets a specific credential-lifecycle failure mode. Most are on by default because the correct answer is obvious. The two that aren't (forced rotation, inactive lock) are opt-in because they change user behavior.
Replace /wp-login.php and /wp-admin/ with a custom slug
like cedar-river. Random two-word generator with ~14,400 combinations.
Bots hit a 404 and move on. The plugin name never appears in the URL, so scanners
can't fingerprint it.
After a correct password, we send a 6-digit code to the user's email. Covers the real threat: someone has the password but not the inbox. Trusted-device cookie keeps things frictionless for 30 days per device, HMAC-signed and revocable.
Every new password checked against Have I Been Pwned via k-anonymity. Only the first 5 characters of the SHA-1 hash ever leave your server. Always on, always silent, fails open if HIBP is unreachable.
The user's last five password hashes are kept and compared on every change. Always on, no setting. Local storage — never touches an external API, never stops working.
Optional. Choose 3, 6, 9, or 12 months. When a user's password expires they're held on the profile screen until they save a new one. Modern guidance (NIST) prefers reuse prevention over rotation — but if your compliance regime requires it, we support it cleanly.
Optional. A daily background job locks accounts that haven't logged in within the configured window. Administrators are never auto-locked. Every admin gets a batch summary email when accounts are locked, with unlock instructions.
One-click button for breach response. Every user is gated to the profile screen on their next admin page load until they save a new password. Optional checkbox also ends every active session immediately — cookies compromised, cookies dead. O(1) design, scales to any user count.
Every time the login URL is set or regenerated, every administrator gets an email with the new URL. The email becomes a permanent inbox record — no more losing the URL because you forgot to write it down.
The design principle
Most security plugins bury critical behavior behind dozens of toggles nobody reads. We took the opposite approach: pick the correct default, ship it, and don't offer a switch. Breach screening, reuse prevention, trusted-device cookies, force-reset gating — all always on. The settings surface is deliberately small.
Login screen
Custom URL slug, redirect target, email 2FA toggle, per-role 2FA scope, force-all-users reset button.
Policy screen
Forced password rotation interval, inactive account lock enable + threshold.
That's it. If you can imagine a knob that isn't in one of those two screens, we probably decided not to offer it. That's not laziness — it's the whole point.
When things break
The number-one support risk for any 2FA plugin is the admin locking themselves out because SMTP went down. We designed around that from day one.
define( 'SILVERBACK_DISABLE_2FA', true );
to wp-config.php. 2FA disengages until you remove the line.
define( 'SILVERBACK_DISABLE_HIDE_LOGIN', true ); restores default
wp-login.php access.
Getting started
Email 2FA and forced rotation are off by default — turn them on once you've confirmed outgoing email works on your site. Full walkthrough is in the docs.
Focused security, correct by default
Silverback Login is free. No account, no license key, no paid tier. Download the plugin, upload to WordPress, and the defaults do the rest.