Takumi Private Gate

Takumi Private Gate turns a WordPress install into a fully private site: nothing is reachable without logging in first. It’s built for people running a diary, notes site, or internal tool on WordPress that should never be publicly visible or crawlable.

Unlike most „force login“ or „password protect“ plugins, Takumi Private Gate combines four protections in a single, dependency-free plugin:

• Site-wide lockdown: every page, post, and feed redirects unauthenticated visitors to the standard WordPress login screen.
• REST API blocking: unauthenticated requests to /wp-json/ receive a 401 Unauthorized response.
• XML-RPC disabled: /xmlrpc.php is fully disabled for everyone, authenticated or not.
• Failed-login lockout: an IP address is locked out for a configurable amount of time after too many failed login attempts, and by default the plugin says nothing that would tell an attacker they’re locked out.

Developed and maintained by Yoshiro Moriyama, founder of Takumi Web Services, a WordPress development studio based in Toronto, Canada.

Features

• Redirects every unauthenticated front-end request to wp-login.php.
• Returns 401 Unauthorized for unauthenticated REST API requests.
• Disables XML-RPC entirely.
• Locks out an IP address after a configurable number of failed login attempts (default: 5 attempts / 30 minutes).
• Lockout state is stored per IP address, not per username.
• Lists every currently locked-out IP with a one-click unlock button.
• Keeps a rolling log (most recent 1000 attempts) of login attempts with date, IP, username, and result.
• Emails the site admin address whenever an IP gets locked out (can be turned off).
• IP whitelist (single IPs or CIDR ranges) that bypasses the lockdown, the API blocking, and the lockout entirely.
• Optional per-user TOTP two-factor authentication (compatible with Google Authenticator, Authy, 1Password, etc.) enrolled from each user’s own profile screen.
• Network-activation aware: sets up per-site defaults and its login-log table on every site of a multisite network.
• Single settings screen under Settings > Private Gate.
• Uninstalling the plugin removes its options, its login-log table, and any 2FA secrets.