IC Security Guard

IC Security Guard is a lightweight, all-in-one security hardening plugin that protects your WordPress site from brute force login attacks, REST API abuse, and XML-RPC amplification attacks — and keeps your site owner informed in real time when an attack is blocked.

Instead of leaving wp-login.php, /wp-admin, xmlrpc.php, and the REST API open for anyone to probe, IC Security Guard lets you move your login page to a custom secret URL, lock out anyone who fails to log in too many times, require a one-time email code before login completes, shut down common XML-RPC and REST API attack vectors, and get emailed the moment something is blocked.

Special Features

Hide Default Login Page

• Hide the default wp-login.php and /wp-admin login pages from unauthenticated visitors
• Serve the login form only on a custom, secret URL that you choose
• Redirect anyone hitting the default login URL to a page of your choice, or a plain 404
• Logged-in users always pass through untouched — no impact on legitimate access

Login Attempt Limiting & Lockout

• Limit failed login attempts with a configurable maximum
• Automatic lockout for a configurable duration after too many failed attempts
• Live countdown timer shown on the login form while locked out
• Lockout state persists across page reloads and resets automatically once it expires
• Correct credentials are still rejected while a lockout is active

Email OTP Two-Factor Authentication

• Optional two-factor authentication using a one-time code sent by email
• After a correct username and password, the user is redirected to a dedicated verification page
• A 6-digit code is emailed to the account’s registered email address and must be entered to complete login
• Configurable code expiry, limited verification attempts, and a resend cooldown to prevent abuse
• Automatically skipped for REST API and XML-RPC requests so API clients and integrations are not broken

REST API & XML-RPC Brute Force Protection

• Optionally disable XML-RPC entirely, closing off system.multicall-based amplification attacks that let attackers test hundreds of password combinations in a single request
• Optionally block unauthenticated REST API user enumeration (/wp-json/wp/v2/users) so attackers cannot harvest valid usernames
• Failed REST API and XML-RPC authentication attempts share the same per-IP lockout as the login form, so an attacker locked out on one entry point is locked out everywhere

Real-time Email Alerts

• Get notified by email the moment a security event is blocked: a login lockout, a blocked XML-RPC request, or a blocked REST API user-enumeration attempt
• Each alert includes the event type, the offending IP address, and the time it occurred
• A configurable cooldown period per alert type keeps a sustained attack from flooding your inbox
• Alerts are sent to your site’s admin email address and are fully optional