Free on WordPress.org

Quiet protection for the one door every attacker tries.

Nahnu Login Shield does one job: it protects every way into your WordPress site. CAPTCHA, lockout, geo-blocking, two-factor and passkeys, from one settings screen.

Install from WordPress.org Try an attack

100% free
No license key
No upsell
Nothing sent to us

Login Shield · LogSample feed

Sample data for illustrationSearch · filter · export CSV

Focused

Not a security suite

One job: guard every way into your site. Less to configure, less to slow down.

Login form
WooCommerce My Account
XML-RPC
REST API
Your forms and comments

Complete

Everything included

No paid tier to hold features back. There isn’t one.

Lockout and honeypots
CAPTCHA, 7 providers
2FA and passkeys
Geo-blocking
Edge WAF integration

$0forever, no key

Private

Your data stays yours

Logs live in your own database. No account, no tracking.

Your siteevent log

Nahnu servernever contacted

Outside services are used only if you choose them.

Try it

Throw an attack at it.

Pick a scenario and watch what Login Shield does at each step. This is a simplified walk-through of the real checks.

Waiting for a scenario—

Choose a scenario on the left.

Result will appear here

What it does

Every layer of login security, in one place.

Turn on what you need. Each feature works on its own, so you can start with lockout alone and add more later.

Brute-force lockout

Escalating lockouts, per-username protection against botnets, and honeypot usernames like “admin” that lock an attacker out on the first try.

CAPTCHA, your way

Choose one of seven providers site-wide, from reCAPTCHA and hCaptcha to Cloudflare Turnstile and the EU-hosted Friendly Captcha. Or use none.

Two-factor authentication

Authenticator app, email code or passkey, in any combination. Backup codes as a fallback, and enforcement by role.

Passkeys and magic links

Let people sign in with Touch ID, Windows Hello or a security key, or with a one-time email link. No password to steal.

Geo-blocking

Block countries using CDN headers with no lookup delay, or free IP services as a fallback. Restrict roles to IP ranges.

Logs and analytics

Searchable event log, 30-day activity chart, attack-time heatmap and top attacking IPs. All stored locally.

Explore all features →

Verification

Bring the CAPTCHA you already trust.

One provider protects every form. If an outside service goes down, legitimate users are never locked out. Tap a provider to preview how it feels.

example.com/wp-login.php

Early block

Bots are turned away before WordPress even loads.

A small must-use plugin checks locked-out IPs first. Flip the switch to see which steps a locked-out bot no longer triggers.

Integrations

Works where your visitors sign in and submit.

The same protections reach your forms, comments and customer accounts.

See all integrations →

WooCommerceMy Account login, register, lost password, checkout

Bricks BuilderForm element protection

SureFormsCAPTCHA and bot checks

WordPress commentsStop comment bots at the door

Using something else? Any form, theme template or headless front end can be protected with a few function calls, shortcodes and a REST API.

Free, properly

No catch, because there’s nothing to catch.

$0

No subscription, license key or locked features.

GPL-2.0+

Open source. Read the code, change it, share it.

30 languages

Translations are included in the plugin.

Local only

Data stays in your WordPress database and is removed if you delete the plugin.

Locked yourself out?

It happens. Here’s the way back in.

Add one line to wp-config.php to bypass lockouts for your own IP, without deactivating the plugin.

Visit the support page

// wp-config.php
define( 'NLS_BYPASS_IP', '203.0.113.10' );

// Or: rename the plugin folder over SFTP
// nahnu-login-shield  →  _nahnu-login-shield

Close the front door. Keep it free.

Install Nahnu Login Shield in a minute. Pick a CAPTCHA, check the lockout defaults, and you’re protected.

Install from WordPress.org