Online Everything Secure Login

• Custom login address: wp-login.php and wp-admin show a 404 page to visitors who do not know your login address.
• Login limits: after a few wrong passwords (5 by default) an IP address is locked for a while (15 minutes by default).
• 2-step email codes: after the password, chosen roles enter a 6-digit code sent to their email. Trusted devices can skip it for 30 days.
• Hardening: hide the WordPress version, switch off XML-RPC, stop user enumeration, add security headers and more, each with its own switch.
• Login log: every successful and failed login, with the user, IP address and time.

If you are ever locked out, add define( 'OESL_OFF', true ); to wp-config.php to switch the plugin off.

External services

This plugin does not connect to any outside service. 2-step codes are sent with WordPress’s own email function.