=== Pantry Login ===
Contributors: pluginpantry
Tags: login
Requires at least: 6.4
Tested up to: 7.1
Stable tag: 1.0.0
Requires PHP: 8.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Limit login attempts and move the login page.

== Description ==

Stop password guessing with a lockout after a few failed attempts, and move the login page to an address of your own. Errors stop revealing whether the username exists. Put your logo on the login form.

Pantry Login is built to the Pantry Standard, a public document that fixes what every Plugin Pantry plugin may and may not do: https://thepluginpantry.com/standard

= What it does =

* Lock out an IP and username after a set number of failed attempts within a window, for a set number of minutes
* Remaining-attempts message and a clear lockout message on the form
* Lockout log of the last 50 events with a masked IP, username and time, stored in one option
* Optional trust of a proxy header for the real IP, off by default
* Custom login address, with wp-login.php and direct wp-admin access for visitors sent to a 404
* Generic error message so the form never confirms a username
* Login form logo with a link to the home page

= What it does not do =

* No two-factor authentication
* No CAPTCHA
* No IP allow or deny lists
* No country blocking
* No external requests

== Pro add-on ==

A separate Pantry Pro add-on is planned. It will extend this plugin with:

* Two-factor authentication with recovery codes
* IP allow and deny lists
* Login notifications
* Cloudflare Turnstile

Nothing in this free plugin is locked or limited. It is complete for its scope.

== Installation ==

1. Upload the plugin folder to /wp-content/plugins/ or install it from the Plugins screen.
2. Activate it.
3. Open Plugin Pantry > Login and set it up.

== Frequently Asked Questions ==

= Does the free plugin expire or nag? =

No. It keeps working forever and never shows a sales notice.

= Does it send any data anywhere? =

No. It makes no external requests.

= Where do I report a bug? =

https://thepluginpantry.com/support

== Changelog ==

= 1.0.0 (2026-09-12) =

* First release.
* Lockout after a set number of failed attempts within a window, counted per address and per address and username together.
* Remaining-attempts message and a lockout message with the time left, shown on the login form.
* Lockout log of the last 50 events with a masked address, the username tried and the time, held in one option.
* Buttons to release every recorded lockout and to clear the log.
* Optional trust of the X-Forwarded-For header for sites behind a proxy, off by default.
* Custom login address, with wp-login.php and wp-admin returning a 404 to logged-out visitors.
* One generic error message so the form never confirms that a username exists.
* Login form logo linked to the home page.
* `pantry_login_locked` action and `pantry_login_generic_message` filter.
