Defentry – Smart Security & Login Protection

Preguntas frecuentes

What happens when someone logs in from a new device?

When an administrator, editor, or author logs in from a device Defentry has never seen, the WordPress dashboard is covered by a full-screen overlay asking for the siren stop password — optionally with a siren sound. Every other logged-in user simultaneously sees a red alert banner (“New device login detected”) with buttons to trust the device, mute the siren, or take Master Admin action.

How do I trust / verify a new device?

Enter the correct siren stop password on the new device and it is trusted permanently. The Master Admin can also trust any device for any user from the alert banner or from Defentry → Manage Trusted Devices.

Who can block or unblock users?

Only the Master Admin — the one administrator designated in the Defentry settings. This keeps emergency response in a single accountable hand.

What exactly does blocking a user do?

The user is added to the blocklist. On their next dashboard visit they are logged out immediately with a notice, and they cannot use wp-admin again until the Master Admin unblocks them from Defentry → Manage Blocked Users.

I don’t hear the siren. Why?

Browsers block audio until you interact with the page (click, scroll, or press a key). The siren starts after your first interaction. You can mute it at any time from the alert banner, or disable/replace it in the Defentry settings.

Can I change the siren sound or turn it off?

Yes. In the Defentry settings you can enable or disable the siren and upload your own MP3. Leave the upload empty to use the built-in siren.

Which user roles are protected?

Administrators, editors, and authors. Contributors, subscribers, and customers are never interrupted.

I forgot the stop password. How do I get back in?

An administrator with database access can delete the scbr_settings row from the wp_options table — the plugin then resets with protection OFF and no stop password set, so you can set a new password. Alternatively, temporarily rename the plugin folder via FTP/cPanel to disable it, then set a new stop password in the settings.

Can an attacker bypass verification by clearing cookies?

No — clearing the cookie generates a brand-new random device ID, which is untrusted by definition, so the overlay appears again. The system fails closed.

Does Defentry replace two-factor authentication (2FA)?

No. Device verification and 2FA stop different attacks — a stolen password alone is useless against Defentry, and a stolen device alone is useless against 2FA. Use both.

Will Defentry slow down my website?

No. Its scripts and styles load only on wp-admin pages, and only when needed. Visitors to your public site are completely unaffected, and the plugin makes no external HTTP requests.

Does it work with caching plugins or Cloudflare?

Yes. Verification happens inside wp-admin, which caching plugins and CDNs don’t cache. One honest note: IP-based attempt limiting reads REMOTE_ADDR; behind a reverse proxy or CDN (like Cloudflare) all visitors may share the proxy’s IP, so an IP block applies proxy-wide. Device verification itself is unaffected.

Is Defentry compatible with multisite?

Settings are stored per site, not network-wide, and multisite has not been officially tested. It should work per-site; network-wide management isn’t included.

What data does Defentry store? Is it private?

Random device IDs (in a browser cookie and per-user metadata), device details (name, trust/expiry dates, last seen), plugin settings (in wp_options), per-IP login attempt counts (kept for 30 days, on your server only), and short-lived transients for login attempts and alerts. Nothing ever leaves your server — no tracking, no telemetry, no third-party calls.

Does it work with custom login pages, social login, or page builders?

Yes. Verification happens inside wp-admin after login, so it works regardless of how the user logged in.

What happens if the Master Admin account is deleted?

Defentry detects the missing Master Admin and prompts an administrator to choose a new one. Protection settings are preserved.

How do I limit login attempts in WordPress?

Use Defentry’s built-in login limiter: failed wp-login attempts are counted per IP address, and after the limit you set (default: 5 failures within 15 minutes) that IP is locked out for 30 minutes — even the correct password is rejected until the lockout expires. You can whitelist your own IP, enable escalating lockouts for repeat offenders, get an email on every lockout, and unlock any IP instantly from Defentry → Protection. No separate limit-login-attempts plugin needed.

How do I stop brute-force attacks on wp-login.php?

Brute-force bots guess passwords until something works. Defentry stops them at three points: the login limiter locks out guessing IPs (including XML-RPC and REST authentication attempts), per-IP login activity shows you exactly which IPs are attacking and which usernames they are trying, and — if a password ever does leak — device verification still blocks the attacker, because a correct password on an unrecognized device only reaches the stop-password verification page.

What happens when an IP is locked out of wp-login?

After too many failed login attempts (default: 5 within 15 minutes), that IP is locked out for 30 minutes — during the lockout even a correct password is rejected with a generic message. If escalating lockouts are enabled, repeat lockouts within 24 hours double in length (up to 24 hours). Whitelisted IPs are never locked out, a successful login clears the failure counter, and the Master Admin can unlock any IP instantly from Defentry → Protection.

I locked myself out. What now?

Wait for the lockout to expire, log in from a different network/IP, or — if you have database access — delete the scbr_lockouts row from wp_options. To prevent this, whitelist your own IP in Defentry → Protection → Login Protection before you need it.

Do trusted devices expire?

Only if you want them to. In Defentry → Verification you can set newly trusted devices to expire after 30, 90, or 180 days (default: never). Devices trusted before you change the setting never expire unless renewed. An expired device simply verifies with the stop password again, exactly like a new device.

What does the per-IP login activity show?

For each IP address: total login requests, how many failed, how many succeeded, which usernames were tried, and when it was last seen — aggregated over the last 7 days in the Protection tab and stored for 30 days. The Master Admin can block an IP for 1 hour, unlock a lockout, or whitelist an IP directly from that table.

How can I see who is trying to log in to my WordPress site?

Open Defentry → Protection → Login Activity by IP. For every IP address you see how many login requests it made in the last 7 days, how many failed, how many succeeded, exactly which usernames it tried, and when it was last seen — so a brute-force attack, a password-spraying bot, or a colleague who keeps mistyping their password is visible at a glance, and you can block, unlock, or whitelist the IP in one click.

Is Defentry really free?

Yes — 100% free, GPL-licensed, no premium version, no upsells, no locked features.