Support
Help, without the runaround.
Most answers are right below. If yours isn’t, send us a message or ask for a new integration. It’s a free plugin, and a real person reads every message.
Locked yourself out?
Start here. It takes a minute.
Add one line to wp-config.php to bypass lockouts for your own IP, without deactivating anything. Full steps are the first question below.
// wp-config.php define( 'NAHNLS_BYPASS_IP', '203.0.113.10' ); // Or: rename the plugin folder over SFTP // nahnu-login-shield → _nahnu-login-shield
FAQ
Quick answers.
I locked myself out. How do I get back in?
Two ways. First, add this line to
wp-config.php, above the “That’s all, stop editing” line. It takes a comma-separated list of IPs and CIDR ranges, and exempts them from lockouts, the IP blocklist, geo-blocking and the early-block rate limit, with no deactivation needed. Second, rename the plugin folder from nahnu-login-shield to _nahnu-login-shield over SFTP, which deactivates it.define( 'NAHNLS_BYPASS_IP', '203.0.113.10, 198.51.100.0/24' );
Do I need OOPSpam installed?
No. OOPSpam is one of seven CAPTCHA provider options. All other providers and every other feature work independently.
Can I use it without any CAPTCHA?
Yes. Set the provider to None. Brute-force lockout, honeypot usernames, geo-blocking, the JavaScript presence check and 2FA all work without one.
What happens if the CAPTCHA service goes down?
Every provider fails open. A network or API error never locks out a legitimate user.
Does it slow my site down?
It’s built not to. Assets load only on wp-login.php and the pages you opt into. The JavaScript check is a tiny inline script with no external request, geo lookups from CDN headers add no delay, and the early-block file turns away locked-out IPs before WordPress loads.
Does it work with WooCommerce?
Yes. The My Account login, registration, lost-password, checkout and order-tracking forms each have their own toggle in the Integrations tab. Customers also get a “Login & security” tab to manage passkeys and 2FA.
Can attackers get around lockout by rotating IPs?
The per-username lockout catches this. If one username is tried from too many IPs within the time window, the username itself is locked everywhere. Adding common targets like
admin, administrator and root to the honeypot list is the strongest protection: one attempt from any IP locks both the IP and the name.How does geo-blocking work if I don’t use a CDN?
CDN headers are always checked first. With none present, it falls back to one of three free IP geolocation services (freeipapi.com, ip-api.com or ipinfo.io), with a configurable cache.
What is the mu-plugin, and is it safe?
On activation the plugin copies
nls-early-block.php into wp-content/mu-plugins/. It checks whether the requesting IP is locked out and, if so, answers with a 403 or 429 before WordPress loads, which greatly reduces load during bot floods. It is removed automatically when you deactivate the plugin.Will it conflict with other security plugins?
It hooks into WordPress login actions and standard WooCommerce and form-plugin hooks. If another plugin uses the same actions, a conflict is possible. If you see one, send us the details below and we’ll look into it.
Does it support multisite?
It hasn’t been tested on multisite, and network activation isn’t recommended.
How do I get my form plugin supported?
Use the integration request form below. Integrations are added based on what people ask for, and the developer API works in the meantime.
Still need us?
Tell us what’s going on.
Pick the kind of message you’re sending.