Defentry – Smart Security & Login Protection Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Stop WordPress account takeover before it starts.
Stolen passwords. Hijacked sessions. Brute-force bots hammering login pages around the clock. Most WordPress breaches don’t break the lock — they steal the key. Defentry adds a second door: device-based login verification for WordPress.
When an administrator, editor, or author signs in from a new, unrecognized device, Defentry instantly covers the dashboard with a full-screen verification overlay and siren until a secret stop password is entered. At the same moment, every other logged-in user sees a real-time login alert banner and hears the siren — so a hijacked session can never slip by silently.
How it works
- A privileged user logs in from a device Defentry has never seen.
- The dashboard is immediately blocked by the stop-password overlay (with optional siren).
- All other logged-in users get an instant alert banner with one-click Trust, Mute, and Master Admin actions.
- The correct stop password verifies and permanently trusts the device. Wrong guesses are rate-limited per IP — 3 strikes triggers a temporary IP block.
Login security features
- New-device verification overlay — unrecognized devices cannot touch wp-admin until the stop password is entered
- Brute-force IP protection — 3 wrong password attempts means a temporary IP block. Detection uses
REMOTE_ADDRonly, so attackers can’t dodge it by spoofingX-Forwarded-Forheaders - Siren + broadcast login alerts — an audible siren and alert banner notify every logged-in user the second a new device appears; custom MP3 siren supported, one-click mute
- Master Admin control — one designated administrator owns the security settings and can instantly block suspicious users (blocked users are logged out on the spot)
- Trusted device management — view, trust, and remove devices per user, or reset all devices at once
- New-device email alerts — administrators, editors, and authors are emailed once per new device with user, time, IP, and device details
- Hardened admin pages — sends
X-Frame-Options,X-Content-Type-Options, andReferrer-Policyheaders on admin screens
Perfect for
- Agencies and freelancers managing client WordPress sites
- WooCommerce stores and membership sites with multiple staff accounts
- Bloggers and businesses who want to know the instant an unknown device touches their dashboard
Built like a security tool should be
- The stop password is hashed with
wp_hash_password()and verified server-side only — never stored in plaintext, never shown in settings, never exposed to the browser - Nonce-protected AJAX, capability checks on every action, sanitized inputs and escaped outputs throughout
- No tracking, no upsells, no bloat — 100% free under the GPL, forever
Defentry is one strong layer of WordPress login security. Pair it with two-factor authentication and a firewall for defense in depth.
Links: Support forum · Author website
Built by WordPress security specialist Md Jahid Bin Sabit.
Credits
Defentry is designed, built, and maintained by Md Jahid Bin Sabit — WordPress security specialist.
- Website: https://jbsabit.com/
- WordPress.org profile: https://profiles.wordpress.org/jbsabit/
Screenshots
New-device verification overlay with the real-time alert banner — what appears the moment an unrecognized device opens wp-admin.
Master control panel — trusted device management, blocked users and one-click device reset.
