| 1 |
=== DoLogin Security === |
| 2 |
Contributors: WPDO |
| 3 |
Tags: Login security, 2FA login, Cloudflare Turnstile, limit login attempts, passwordless login |
| 4 |
Requires at least: 4.4 |
| 5 |
Requires PHP: 5.6 |
| 6 |
Tested up to: 7.1 |
| 7 |
Stable tag: 5.0.10 |
| 8 |
License: GPLv3 |
| 9 |
License URI: http://www.gnu.org/licenses/gpl.html |
| 10 |
|
| 11 |
Login security: KeyLockr SSO scan login, 2FA, passwordless login, Cloudflare Turnstile, GeoLocation/IP limits, whitelist and blacklist. |
| 12 |
|
| 13 |
== Description == |
| 14 |
|
| 15 |
In one click, your WordPress login page will be pretected with the smart brute force attack protection! Any login attempts more than 6 in 10 minutes (default value) will be limited. |
| 16 |
|
| 17 |
Limit the number of login attempts through both the login and the auth cookies. |
| 18 |
|
| 19 |
* Two-factor Authentication login. |
| 20 |
|
| 21 |
* KeyLockr SSO scan login with encrypted appdata hash verification and session-bound encryption. |
| 22 |
|
| 23 |
* Cloudflare Turnstile (better than Google reCAPTCHA). |
| 24 |
|
| 25 |
* GeoLocation (Continent/Country/City) or IP range to limit login attempts. |
| 26 |
|
| 27 |
* Passwordless login link. |
| 28 |
|
| 29 |
* Support Whitelist and Blacklist. |
| 30 |
|
| 31 |
* GDPR compliant. With this feature turned on, all logged IPs get obfuscated (md5-hashed). |
| 32 |
|
| 33 |
* WooCommerce Login supported. |
| 34 |
|
| 35 |
* XMLRPC gateway protection. |
| 36 |
|
| 37 |
= 🛡️ Security, explained simply = |
| 38 |
|
| 39 |
🔑 **A stolen database should not become a bag of ready-to-use login secrets.** |
| 40 |
|
| 41 |
DoLogin separates stored data from the WordPress authentication salts. If an attacker copies only the database—but does not have the salts from the site configuration—the protected values cannot be used as login links, TOTP seeds, or signing keys. |
| 42 |
|
| 43 |
--------------------------------------- |
| 44 |
|
| 45 |
🔗 **Passwordless and child-site tokens: compare without storing the secret** |
| 46 |
|
| 47 |
`Secret in the generated link` ➜ `salt-keyed HMAC` ➜ `database stores only the verifier` |
| 48 |
|
| 49 |
* The raw token is shown when it is created and is never saved in the token table. |
| 50 |
* Login recomputes the HMAC and compares it in constant time. |
| 51 |
* A copied database verifier cannot be pasted into a URL as a working login token. |
| 52 |
* One-time tokens are consumed with an atomic database update, so simultaneous replay attempts cannot both win. |
| 53 |
|
| 54 |
--------------------------------------- |
| 55 |
|
| 56 |
🔐 **TOTP and signing keys: encrypted when the server must recover them** |
| 57 |
|
| 58 |
`TOTP seed or private key` ➜ `authenticated encryption + site salt` ➜ `ciphertext in the database` |
| 59 |
|
| 60 |
TOTP verification and digital signatures need the original secret at runtime, so these values cannot use a one-way hash. DoLogin encrypts them instead and rejects modified ciphertext. Existing TOTP seeds and Site Easy Login private keys are migrated automatically. |
| 61 |
|
| 62 |
--------------------------------------- |
| 63 |
|
| 64 |
🏠 **Site Easy Login: one signed message, one destination, one use** |
| 65 |
|
| 66 |
`User + trusted public key + destination + issue time + random token ID` ➜ `one Ed25519 signature` |
| 67 |
|
| 68 |
The child site verifies the complete signed message with the public key already saved for that connection. Changing the user or destination breaks the signature, and an atomic consume step blocks replay. |
| 69 |
|
| 70 |
--------------------------------------- |
| 71 |
|
| 72 |
📱 **KeyLockr SSO: stable signing and encryption identity** |
| 73 |
|
| 74 |
`Scan QR` ➜ `approve on phone` ➜ `verify Safe + AppData binding` ➜ `WordPress login cookie` |
| 75 |
|
| 76 |
* Fixed per-site signing and encryption keypairs let KeyLockr reuse the same backend-owned connection identity. |
| 77 |
* Existing signing-only key storage is upgraded atomically with one persistent encryption keypair. |
| 78 |
* The WordPress backend owns all private keys and KPS processing; the browser only opens the short-lived KeyLockr WebSocket and relays opaque signed, encrypted frames to the backend. |
| 79 |
* Incoming frames are signed, encrypted, timestamp-checked, replay-checked, rate-limited, and accepted only in the expected protocol phase. |
| 80 |
* Bind and Repair write the WordPress account hash to encrypted KeyLockr AppData, then read it back before completing. |
| 81 |
* Login requires exactly one WordPress user with the matching Safe ID and binding hash. |
| 82 |
* After a QR scan, the phone-unlock and approval prompt is highlighted in green so the next action is clear. |
| 83 |
|
| 84 |
--------------------------------------- |
| 85 |
|
| 86 |
🚦 **Force KeyLockr SSO that fails closed** |
| 87 |
|
| 88 |
`Enable force mode after a verified admin binding` ➜ `keep QR-only policy active` ➜ `never reopen older interactive login methods automatically` |
| 89 |
|
| 90 |
DoLogin checks the current administrator binding before force mode can be enabled. After that policy is saved, a missing binding, changed App Tag, broken site identity, or unavailable KeyLockr service does not restore password, passwordless-link, connected-site, or password-reset login paths. The WordPress lost-password link and core password-reset screens are removed while force mode is active; unlinking and site-key reset are also blocked. Existing authenticated sessions can disable force mode from settings; if no session remains, rename the plugin folder through FTP or the hosting file manager before repairing the connection. WordPress Application Passwords remain available for API clients. |
| 91 |
|
| 92 |
= API = |
| 93 |
|
| 94 |
* Call the function `$link = function_exists( 'dologin_gen_link' ) ? dologin_gen_link( 'your plugin name or tag' ) : '';` to generate one passwordless login link for the current user. |
| 95 |
|
| 96 |
* Call the function `$link = function_exists( 'dologin_gen_link' ) ? dologin_gen_link( 'note/tip for this generation', $user_id ) : '';` to generate a passwordless login link for the user which ID is `$user_id`. |
| 97 |
|
| 98 |
The generated one-time used link will be expired after 7 days. |
| 99 |
|
| 100 |
* Define const `SILENCE_INSTALL` to avoid redirecting to setting page after installtion. |
| 101 |
|
| 102 |
= KeyLockr SSO Recovery = |
| 103 |
|
| 104 |
Forced KeyLockr SSO blocks password, passwordless-link, and connected-site interactive logins. Existing authenticated cookies and WordPress Application Passwords remain available. |
| 105 |
|
| 106 |
DoLogin never restores another interactive login method because KeyLockr is unavailable or the saved binding becomes invalid. Use an existing authenticated administrator session to disable force mode. If no such session remains, rename the plugin folder through FTP or the hosting file manager, then repair the connection before enabling force mode again. |
| 107 |
|
| 108 |
= CLI = |
| 109 |
|
| 110 |
* List all passwordless links: `wp dologin list` |
| 111 |
|
| 112 |
* Generate a passwordless link for one username (for the login name `root`): `wp dologin gen root` |
| 113 |
|
| 114 |
* Delete a passwordless link w/ the ID in list (for the record w/ ID 5): `wp dologin del 5` |
| 115 |
|
| 116 |
= How GeoLocation works = |
| 117 |
|
| 118 |
When visitors hit the login page, this plugin will lookup the Geolocation info from API, compare the Geolocation setting (if has) with the whitelist/blacklist to decide if allow login attempts. |
| 119 |
|
| 120 |
== Privacy == |
| 121 |
|
| 122 |
The online IP lookup service is provided by https://www.doapi.us. The provider's privacy policy is https://www.doapi.us/privacy. |
| 123 |
|
| 124 |
Based on the original code from Limit Login Attemps plugin and Limit Login Attemps Reloaded plugin. |
| 125 |
|
| 126 |
== Screenshots == |
| 127 |
|
| 128 |
1. Plugin Site Connections |
| 129 |
2. Plugin Settings |
| 130 |
3. Plugin Passwordless Login |
| 131 |
4. Plugin Login Attempts Log |
| 132 |
5. Login Page (KeyLockr SSO QR login) |
| 133 |
6. Login Page (2 times left) |
| 134 |
7. Login Page (Too many failure) |
| 135 |
8. Login Page (Blacklist blocked) |
| 136 |
9. WooCommerce login protection |
| 137 |
|
| 138 |
== Changelog == |
| 139 |
|
| 140 |
= 5.0.10 - Aug 15 2026 = |
| 141 |
* 🍀 Added verified same-device KeyLockr login, simplified MyDeveloper guidance, and reduced login-page assets. |
| 142 |
* 🔐 Hardened KeyLockr SSO, 2FA replay cleanup, and uninstall data removal. |
| 143 |
* 🔐 Made only KeyLockr authorization denials and account-identity mismatches consume login retries, preventing protocol or transport errors from locking out an IP. |
| 144 |
* 🐞 Fixed stale same-device returns, WooCommerce forced-login flashes, token-error pages, and login-log feedback. |
| 145 |
|
| 146 |
= 4.8.3 - Jul 28 2026 = |
| 147 |
* 🐞 Kept valid KeyLockr site-key blobs read-only and limited storage migration to signing-only blobs, preventing avoidable login failures when no key material needs an upgrade. |
| 148 |
* 🔐 Restored a fixed per-site KeyLockr encryption keypair and atomically upgraded signing-only storage so repeated QR logins reuse the same backend-owned encryption identity. |
| 149 |
* 🐞 Stopped passive visits to the WordPress login page from being counted as failed login attempts while Force KeyLockr SSO is enabled. |
| 150 |
* 🍀 Highlighted the post-scan KeyLockr unlock and approval prompt in green so users can see that the next action is on their phone. |
| 151 |
* 🔐 Removed lost-password links across supported WordPress versions and blocked both new and pre-issued password-reset keys across core and third-party reset flows while Force KeyLockr SSO keeps username/password login disabled. |
| 152 |
|
| 153 |
= 4.7.7 - Jul 22 2026 = |
| 154 |
* 🍀 Made the login-page KeyLockr sign-in start on demand with clear DoLogin branding and a KeyLockr reference link, instead of opening a connection on every login-page visit. |
| 155 |
* 🔐 Protected passwordless and site-connection tokens with salt-keyed HMAC verifiers, and encrypted TOTP and Site Easy Login private keys at rest. |
| 156 |
* 🐞 Fixed an upgrade fatal error by waiting until WordPress salt APIs are available before running migrations. |
| 157 |
* 🔐 Added and hardened KeyLockr SSO QR login with reusable site identity, secure account linking and repair, encrypted AppData verification, bounded decoding, rate-limited replay-resistant sessions, validated redirects, and fail-closed forced login that never restores older interactive methods automatically. |
| 158 |
* 🔐 Fixed Site Easy Login assertion tampering and replay by signing the user, public key, destination, issuance time, and token ID together, then atomically consuming each assertion. |
| 159 |
* 🔐 Hardened 2FA and token login by failing closed when a forced 2FA secret is missing, enforcing lockouts, binding confirmation nonces, and atomically consuming replay state. |
| 160 |
* 🐞 Fixed IPv4/IPv6 allow/deny matching, settings return behavior, deleted-user handling, and multisite table provisioning. |
| 161 |
* 🔐 Restricted companion-plugin installation and protected GeoIP and Turnstile requests while reducing unnecessary external traffic. |
| 162 |
* 🧹 Removed legacy SMS login, the obsolete mobile-number profile field, and the SMS database table. |
| 163 |
|
| 164 |
= 4.4 - Jul 6 2026 = |
| 165 |
* 🐞 Security: Fixed an authentication bypass via insufficient randomness in passwordless and site-connection login tokens (CVE-2026-14495). Login tokens and SMS codes are now generated with a cryptographically secure random source. |
| 166 |
* 🐞 Security: Fixed an unauthenticated stored XSS in the Login Attempts log, dashboard widget, and Site Connections tables. All output is now escaped. |
| 167 |
* 🐞 Security: The per-IP failure limit is now enforced on the passwordless and easy-login endpoints; token comparison is constant-time. |
| 168 |
* 🐞 Security: Enabled TLS verification on outbound API calls, validated the site-connection URL (SSRF), switched to safe redirects, and added a no-referrer policy on the passwordless confirmation page to prevent token leakage. |
| 169 |
* 🐞 Cloudflare Turnstile no longer blocks XML-RPC authentication, which cannot present a captcha and is already covered by the login attempt limiter. |
| 170 |
* Declared WooCommerce HPOS (High-Performance Order Storage) compatibility. |
| 171 |
|
| 172 |
= 4.3 - Jun 11 2025 = |
| 173 |
* Generating passwordless link will redirect to the corresponding tab now. |
| 174 |
|
| 175 |
= 4.2 - May 31 2025 = |
| 176 |
* 🍀 Cloudflare Turnstile reCAPTCHA. |
| 177 |
* 🐞 Fixed 2FA conflict w/ reCAPTCHA. |
| 178 |
|
| 179 |
= 4.1.1 - May 27 2025 = |
| 180 |
* Resolved WooCommerce HPOS feature warning. |
| 181 |
|
| 182 |
= 4.1 - May 27 2025 = |
| 183 |
* Showed the easy login confirmation landing page. |
| 184 |
* Disallowed reuse of login link to prevent possible replay attack. |
| 185 |
* Fixed root site pk/sk clear issue in easy login when saving conf. |
| 186 |
* Restored reCAPTCHA to previous version. |
| 187 |
|
| 188 |
= 4.0 - May 26 2025 = |
| 189 |
* 🍀 `Easy Login` feature! Allow one root WordPress to easy login to multi child WordPress sites. |
| 190 |
|
| 191 |
= 3.8 = |
| 192 |
* Security patch per patchstack report. |
| 193 |
|
| 194 |
= 3.7.1 = |
| 195 |
* IP vulnerability patch for dashboard widget. (Bob@Jetpack) |
| 196 |
|
| 197 |
= 3.7 = |
| 198 |
* IP vulnerability patch. (Bob@Jetpack) |
| 199 |
|
| 200 |
= 3.6 = |
| 201 |
* Fixed Google reCAPTCHA authentication failure. (mandotr) |
| 202 |
|
| 203 |
= 3.5.2 = |
| 204 |
* Fixed auto upgrade PHP warning. (lavacano) |
| 205 |
|
| 206 |
= 3.5.1 = |
| 207 |
* Banner to install qrcode plugin to enable 2FA. |
| 208 |
|
| 209 |
= 3.5 = |
| 210 |
* 🍀 Two-factor Authentication. |
| 211 |
|
| 212 |
= 3.4 = |
| 213 |
* Bypassed version check to speed up WP6 loading. |
| 214 |
|
| 215 |
= 3.3 = |
| 216 |
* Fixed potential duration value in string conversion issue. (wpcrono) |
| 217 |
|
| 218 |
= 3.2 = |
| 219 |
* API `dologin_admin_menu_access` to allow other users to config dologin settings. (franfal) |
| 220 |
|
| 221 |
= 3.1 = |
| 222 |
* Compatibility improvement when communication failed between client wordpress and DoAPI.us API. (@matteocuellar @ecomturbo @thesaintindiano) |
| 223 |
|
| 224 |
= 3.0 = |
| 225 |
* 🍀 Dashboard widget. |
| 226 |
* New API for free text message gateway. |
| 227 |
|
| 228 |
= 2.9.4 = |
| 229 |
* Fixed IXR_Error PHP notice for XMLRPC login failure. |
| 230 |
|
| 231 |
= 2.9.3 = |
| 232 |
* Support translation for login text message. (@merkwert) |
| 233 |
|
| 234 |
= 2.9.2 = |
| 235 |
* More accurate to detect IP. |
| 236 |
|
| 237 |
= 2.9.1 = |
| 238 |
* 🍀 New setting Google reCAPTCHA on Lost Password Page. |
| 239 |
|
| 240 |
= 2.9 = |
| 241 |
* WordPress v5.5 Rest compatibility. |
| 242 |
|
| 243 |
= 2.8 = |
| 244 |
* Avoid duplicated login attempt records for one IP in a short time. |
| 245 |
* GUI enhancement. |
| 246 |
|
| 247 |
= 2.7.1 = |
| 248 |
* Added API info to GUI. |
| 249 |
|
| 250 |
= 2.7 = |
| 251 |
* Login Attempts log can be cleared now. |
| 252 |
|
| 253 |
= 2.6 = |
| 254 |
* Codebase reformated. |
| 255 |
|
| 256 |
= 2.5 = |
| 257 |
* CLI supported. |
| 258 |
|
| 259 |
= 2.4 = |
| 260 |
* Passwordless link can be copied in one click. |
| 261 |
|
| 262 |
= 2.3 = |
| 263 |
* 🍀 Reverse Matching w/ `!:` feature. Now can use `!:` to exclude one rule. (@jacklinkers) |
| 264 |
|
| 265 |
= 2.2.2 = |
| 266 |
* Better IP detection. |
| 267 |
* Supported empty line and single line comments for whitelist and blacklist. |
| 268 |
|
| 269 |
= 2.2.1 = |
| 270 |
* Declared WooCommerce support up to 4.0.1. |
| 271 |
|
| 272 |
= 2.2 = |
| 273 |
* Whitelist and Blacklist support comments now. |
| 274 |
|
| 275 |
= 2.1 = |
| 276 |
* Passwordless login will now have a confirm page to avoid auto-visited when sharing the link. |
| 277 |
|
| 278 |
= 2.0 = |
| 279 |
* Fresh New GUI! |
| 280 |
|
| 281 |
= 1.9 = |
| 282 |
* 🍀 New option: Show reCAPTCHA on Register page. (@ach1992) |
| 283 |
|
| 284 |
= 1.8 = |
| 285 |
* 🍀 Show Phone Number field on Register page if Force SMS Auth setting is ON. (@ach1992) |
| 286 |
|
| 287 |
= 1.7.1 = |
| 288 |
* 🐞 Will now honor the timezone setting when showing date of sent. (@ducpl) |
| 289 |
|
| 290 |
= 1.7 = |
| 291 |
* Supported DoDebug now. |
| 292 |
* Bypassed whitelist check for WooCommerce clients on checkout page. |
| 293 |
* 🐞 WooCommerce checkout page can now login correctly. |
| 294 |
|
| 295 |
= 1.6 = |
| 296 |
* 🍀 Google reCAPTCHA. |
| 297 |
* 🐞 WooCommerce can now use same login strategy settings. |
| 298 |
|
| 299 |
= 1.5 = |
| 300 |
* 🍀 Test SMS Message feature under Settings page. |
| 301 |
|
| 302 |
= 1.4.7 = |
| 303 |
* Language supported. |
| 304 |
|
| 305 |
= 1.4.5 = |
| 306 |
* PHP5.3 supported. |
| 307 |
|
| 308 |
= 1.4.4 = |
| 309 |
* Doc updates. |
| 310 |
|
| 311 |
= 1.4.3 = |
| 312 |
* *API* Silent install mode to avoid redirecting to settings by defining const `SILENCE_INSTALL` |
| 313 |
|
| 314 |
= 1.4.2 = |
| 315 |
* *API* Generated link defaults to expire in 7 days. |
| 316 |
|
| 317 |
= 1.4.1 = |
| 318 |
* *API* New function `dologin_gen_link( 'my_plugin' )` API to generate a link for current user. |
| 319 |
|
| 320 |
= 1.4 = |
| 321 |
* 🍀 Passwordless login link. |
| 322 |
|
| 323 |
= 1.3.5 = |
| 324 |
* SMS PHP Warning fix. |
| 325 |
|
| 326 |
= 1.3.4 = |
| 327 |
* REST warning fix. |
| 328 |
|
| 329 |
= 1.3.3 = |
| 330 |
* GUI cosmetic. |
| 331 |
|
| 332 |
= 1.3.2 = |
| 333 |
* 🐞 Fixed a bug that caused not enabled SMS WP failed to login. |
| 334 |
|
| 335 |
= 1.3.1 = |
| 336 |
* PHP Notice fix. |
| 337 |
|
| 338 |
= 1.3 = |
| 339 |
* 🍀 SMS login support. |
| 340 |
|
| 341 |
= 1.2.2 = |
| 342 |
* Auto redirect to setting page after activation. |
| 343 |
|
| 344 |
= 1.2.1 = |
| 345 |
* Doc improvement. |
| 346 |
|
| 347 |
= 1.2 = |
| 348 |
* 🍀 XMLRPC protection. |
| 349 |
|
| 350 |
= 1.1.1 = |
| 351 |
* 🐞 Auto upgrade can now check latest version correctly. |
| 352 |
|
| 353 |
= 1.1 = |
| 354 |
* 🍀 *New* Display login failure log. |
| 355 |
* 🍀 *New* GDPR compliance. |
| 356 |
* 🍀 *New* Auto upgrade. |
| 357 |
* *GUI* Setting link shortcut from plugin page. |
| 358 |
* *GUI* Display security status on login page. |
| 359 |
* 🐞 Stale settings shown after successfully saved. |
| 360 |
* 🐞 Duration setting can now be saved correctly. |
| 361 |
* 🐞 Fully saved geo location failure log. |
| 362 |
|
| 363 |
= 1.0 - Sep 27 2019 = |
| 364 |
* Initial Release. |
| 365 |
|
