PressGate

Advanced WordPress Login Defense

PressGate is a dedicated authentication control plugin for WordPress that adds intelligent, policy driven protection to every login attempt. It monitors failed logins, high velocity requests, username spraying, bot activity, suspicious login paths, and impossible travel patterns. Administrators can configure independent security policies for different user roles, including attempt limits, lockout durations, two factor authentication requirements, step up challenges, rate limits, and local IP allowlists and blocklists. Each login is evaluated using local behavior signals, role specific rules, and available IP reputation intelligence to determine whether access should be allowed, challenged, or blocked.

Core Capabilities

Brute-Force & Spray Detection

Automatically identifies and blocks brute-force attempts, username spraying, and high-velocity login floods based on configurable thresholds and time windows.

Two-Factor Authentication

Built-in TOTP-based 2FA with Google Authenticator support. Enforce it per role, and require it for admins while keeping subscriber login friction-free.

Role-Aware Lockout Policies

Configure max failed attempts, lockout duration, rate limits, and step-up authentication independently for each WordPress user role.

Bot Scanner

Detects known attack-tool User-Agent signatures and automated login scripts. Blocks scanners like WPScan, Hydra, and custom bots before they try a single credential.

IP Management

Block individual IPs or CIDR ranges manually. Allowlist trusted office IPs to bypass all checks. Automatic temporary lockouts for detected attackers.

Full Audit Logging

Every login attempt logged with timestamp, IP, username, result, and detection category. Paginated log viewer and a dashboard widget with 24-hour threat summaries.