Title: eSherpa Login Guard Author: Ralf Naumann Published: 25. Dezember 2025 Last modified: 3. März 2026 --- Search plugins ![](https://ps.w.org/esherpa-login-guard/assets/banner-772x250.jpg?rev=3427167) ![](https://ps.w.org/esherpa-login-guard/assets/icon-256x256.png?rev=3427167) # eSherpa Login Guard By [Ralf Naumann](https://profiles.wordpress.org/r2d3/) [Download](https://downloads.wordpress.org/plugin/esherpa-login-guard.3.0.0.zip) * [Details](https://de-ch.wordpress.org/plugins/esherpa-login-guard/#description) * [Reviews](https://de-ch.wordpress.org/plugins/esherpa-login-guard/#reviews) * [Installation](https://de-ch.wordpress.org/plugins/esherpa-login-guard/#installation) * [Development](https://de-ch.wordpress.org/plugins/esherpa-login-guard/#developers) [Support](https://wordpress.org/support/plugin/esherpa-login-guard/) ## Description **eSherpa Login Guard** effectively and intelligently protects your WordPress site from brute-force attacks – Swiss precision, completely without external dependencies. **Key Features:** * **Honeypot-first bot defense**: JavaScript Honeypot detects non-browser bots and triggers immediate lockout logic. * **Protected username trap**: Immediate lockout for defined usernames (e.g., « admin», «test»), independent of the regular counter. * **Proactive User-Agent blocking**: Block known bot signatures before login processing( exact match or substring mode). * **Blocked User-Agent attempt log**: Separate log table for blocked User-Agent requests including matching pattern. * **WordPress hardening options**: Disable XML-RPC (with fake-user honeypot response), hide REST user endpoint, and block author archive enumeration. * **Optional bot password capture**: Store attempted passwords from detected JS- honeypot bots for incident analysis. * **Neutral login error option**: Hide username enumeration by using neutral WordPress login error responses. * **Live security visibility**: Live alarm in admin, lockout badge in menu, and detailed failed-attempt logs with IP/User-Agent filters. * **Progressive lockout durations**: Lockout time increases on repeat offenses ( e.g., 15 30 60 120 minutes). * **Login page guidance**: Clear countdown and «X attempts remaining» notice for transparent lock state. * **Privacy-compliant**: IPs stored only as anonymized hashes. * **Automatic cleanup** of old failed attempts (configurable). * **Mobile-friendly admin tables**: Horizontal scrolling for wide security tables on small screens, including swipe hint. * **Email notification** to admin on attacks against existing users. Developed in Switzerland – fast, clean, performant, and multilingual ready. Compatible with WordPress 6.9 and tested up to PHP 8.5.3. ## Screenshots [⌊Lockout message with large countdown and plugin credit⌉⌊Lockout message with large countdown and plugin credit⌉[ Lockout message with large countdown and plugin credit [⌊Early warning on login page with remaining attempts⌉⌊Early warning on login page with remaining attempts⌉[ Early warning on login page with remaining attempts [⌊Admin overview with currently locked IPs, live alarm, and unblock option⌉⌊Admin overview with currently locked IPs, live alarm, and unblock option⌉[ Admin overview with currently locked IPs, live alarm, and unblock option [⌊Detailed logs of failed attempts (including attempted username)⌉⌊Detailed logs of failed attempts (including attempted username)⌉[ Detailed logs of failed attempts (including attempted username) [⌊Successful logins & logouts in separate view⌉⌊Successful logins & logouts in separate view⌉[ Successful logins & logouts in separate view ## Installation 1. Search for the plugin in «Plugins Add New ‚esherpa login guard’» or upload and activate. 2. Optional: Adjust settings under «Login Guard» in the admin menu (e.g., max failed attempts, base lockout time, protected usernames). 3. Done – protection runs automatically. ## FAQ ### How are IPs stored? Only as anonymized MD5 hashes – no plain-text IPs in the database (GDPR-compliant). ### Can I manually unblock IPs? Yes – directly in the admin overview with one click (counter is reset). ### Does it work with caching plugins? Yes – protection hooks early on wp-login.php, before caching. ### What happens on successful login? All counters and locks for that IP are immediately cleared. ### Can I still use XML-RPC? Yes – simply disable the option. When enabled, XML-RPC is fully disabled and a honeypot is activated. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “eSherpa Login Guard” is open source software. The following people have contributed to this plugin. Contributors * [ Ralf Naumann ](https://profiles.wordpress.org/r2d3/) [Translate “eSherpa Login Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/esherpa-login-guard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/esherpa-login-guard/), check out the [SVN repository](https://plugins.svn.wordpress.org/esherpa-login-guard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/esherpa-login-guard/) by [RSS](https://plugins.trac.wordpress.org/log/esherpa-login-guard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 3.0.0 * Release: Version bump to 3.0.0 for the current major feature set. * UI (Mobile): Admin log tables are now horizontally scrollable on small screens. * UI (Mobile): Added a visible swipe/scroll hint for wide tables. * UI: Reduced «blocked User-Agent attempts» list in admin overview from 50 to 20 entries for better readability. * Docs: Expanded README feature list (proactive User-Agent blocking, blocked-UA logs, neutral login errors, bot password capture, mobile table UX). #### 2.7.0 * Feature: JavaScript Honeypot for automatic bot detection with progressive lockout( like protected usernames) * UI: Visual bot indicators (🤖 emoji) in both locked IPs and failed attempts tables * UI: Clickable User-Agent filtering in all log tables (like IP filtering) – optimized display to 100 chars * Security: Enhanced bot detection combining multiple methods * Fix: XML-RPC Honeypot now generates properly formatted XML without double-escaping #### 2.6.0 * Security: Fixed critical IP address handling vulnerability – now properly supports proxy headers * Feature: Added comprehensive User-Agent logging to all login attempts and successful logins * Feature: Added JavaScript Honeypot for automatic bot detection (1-hour lockout) * Performance: Optimized admin menu badge query with caching * Security: Enhanced input validation with reasonable limits on all settings * UI: Visual bot indicators in admin tables with 🤖 emoji * Code: Improved code formatting and consistency throughout #### 2.5.4 * Fix: Immediate lockout for protected usernames (honeypot usernames) was setting back attemts and multipliers * Sort by IP -> Better overview for single IP hashs. * Improved design for mobile #### 2.5.1 * Immediate lockout for protected usernames (honeypot usernames) * Live alarm for new failed attempts on admin page * Email notification on attacks against existing users * Extended XML-RPC honeypot with configurable fake users * Automatic cleanup of old failed attempts * Improved design and many detail enhancements #### 2.1.1 * Full multilingual support (DE/EN/FR/IT) * Confirmed compatibility with WordPress 6.9 and PHP 8.3 * Minor optimizations #### 2.0 * Introduced progressive lockout times * Admin menu with red badge for active locks * Improved user guidance #### 1.0 * Initial stable release ## Meta * Version **3.0.0** * Last updated **7 Monaten ago** * Active installations **Fewer than 10** * WordPress version ** 5.6 or higher ** * Tested up to **6.9.10** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/esherpa-login-guard/) * Tags * [bot protection](https://de-ch.wordpress.org/plugins/tags/bot-protection/)[brute force protection](https://de-ch.wordpress.org/plugins/tags/brute-force-protection/) [honeypot](https://de-ch.wordpress.org/plugins/tags/honeypot/)[login security](https://de-ch.wordpress.org/plugins/tags/login-security/) [wordpress hardening](https://de-ch.wordpress.org/plugins/tags/wordpress-hardening/) * [Advanced View](https://de-ch.wordpress.org/plugins/esherpa-login-guard/advanced/) ## Ratings Es wurden noch keine Rezensionen eingereicht. [Your review](https://wordpress.org/support/plugin/esherpa-login-guard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/esherpa-login-guard/reviews/) ## Contributors * [ Ralf Naumann ](https://profiles.wordpress.org/r2d3/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/esherpa-login-guard/)