Pantry Login compared with Limit Login Attempts Security, WPS Hide Login, Loginizer and Wordfence

Login security on a WordPress site is really two small jobs: stop a script from guessing passwords by hammering the login form, and stop that same script from finding the login form in the first place. Together they take a few settings, not a dashboard.

Both jobs are usually handled by one of a handful of very large plugins, some built for exactly this and some built as a much wider security product with login protection as one section of many. Either way, a site owner who only wants failed logins throttled and the address moved ends up installing something with a firewall, a malware scanner, a two-factor rollout, a country-blocking list and a pricing page attached to it.

This article compares Pantry Login with four of the most-installed plugins for this job: Limit Login Attempts Security, WPS Hide Login, Loginizer and Wordfence. It is not one-sided. Two of the four now give away, for free, things Pantry Login will never add, and for the reader who needs those things, that is the honest answer.

The plugins most people install

Limit Login Attempts Security has 1+ million active installations and is tested up to WordPress 7.1. It is built by WPChef, and the listing itself notes the plugin has grown out from the older Limit Login Attempts Reloaded name. The free version limits attempts by IP address and by username, locks out suspicious activity for an adjustable period, logs failed attempts, emails a notice on lockout, and now also ships built-in two-factor authentication, IP and username allow and deny lists, IPv6 range support, and protection for WooCommerce and XML-RPC login paths. A separate cloud-based Premium add-on, sold in Personal, Business and Agency tiers licensed per domain, adds real-time malicious-IP intelligence shared across sites and country-based blocking.

WPS Hide Login has 2+ million active installations and is tested up to WordPress 7.1. It is built by WPServeur, a WordPress hosting company, and does one thing: it changes the address of the login form so requests to wp-login.php and wp-admin no longer reach it while logged out. There is no paid tier; the plugin is free, and its own listing and settings screen promote WPServeur's hosting alongside it. It does not limit login attempts, and the author ships that as a separate free plugin, WPS Limit Login.

Loginizer has 1+ million active installations and is tested up to WordPress 7.1. Its free version blocks an IP after too many failed attempts, keeps a log, and allows custom error text on a failed login. Renaming the login page, two-factor authentication by email or app, reCAPTCHA, country blocking and passwordless login all sit behind Loginizer Premium, sold in Personal, Blogger, Professional and Business tiers running from $24 to $150 a year, plus a pay-as-you-go Agency plan for larger portfolios.

Wordfence has 5+ million active installations and is tested up to WordPress 7.1, the largest of the four by a wide margin. It is a full firewall and malware-scanning product, and login protection is one part of that: the free version includes brute-force login limiting, a login-page CAPTCHA, IP blocking, and, unusually for a free tier, two-factor authentication and passkey support. Wordfence Premium adds real-time firewall and malware-signature updates, a real-time IP blocklist shared across the Wordfence network, country blocking, and a tamper-resistant security audit log, sold as an annual per-site licence.

Where the big plugins cost you

Three of the four sell country blocking as a paid feature: Limit Login Attempts Security, Loginizer and Wordfence all reserve it for their premium tier, even though the setting itself is a short list on a page the free version already renders. Loginizer goes further and keeps its rename-login-page option, which does the same job as the whole of WPS Hide Login, behind the same paywall as its two-factor authentication and reCAPTCHA.

Wordfence's free tier is generous for login security specifically, but it arrives attached to a much bigger product. Turning on brute-force limiting and two-factor authentication means running a web application firewall with delayed rule updates, a file and theme malware scanner, and live traffic logging, all sharing one settings area built for a security team's workflow rather than one setting a site owner wants switched on and left alone.

WPS Hide Login is the smallest and plainest of the four, and it only ever does the one job in its name. It does not limit anything, so a site running it alone is still open to unlimited password guesses at whatever address the login form now sits behind, and its own settings screen carries hosting promotion for its maker alongside the address field.

Limit Login Attempts Security has grown well past its original scope since the rename. What used to be a small attempt-counter now ships free two-factor authentication, IP and username allow and deny lists, and WooCommerce and XML-RPC coverage, each with its own settings. None of that is paywalled, which is generous, but it means the free plugin itself has become a wider surface than a site that only wants a lockout needs to read through.

What Pantry Login does instead

Pantry Login's scope is the two jobs together: count failed logins, lock out the address and username combination that caused them, and optionally serve the login form at an address you choose. Two counters run in parallel, one for the address and one for the address paired with the username being tried, so an attacker cannot dodge the address-based limit by cycling through usernames from the same connection; whichever counter reaches the limit first starts the lockout, and it covers both. A successful login clears both counters for that address. Everything is a WordPress transient, so a counter or a lockout expires on its own schedule and the database never accumulates rows.

The lockout log keeps the last 50 events with a time, the attempts counted, the lockout length and the address with its last octet, or last IPv6 hextet, replaced by xxx. Storing the range rather than the exact address is enough to tell whether the same connection is behind repeated attempts without keeping a value that identifies one specific household or device, which matters because the log is one plain database option with no access control beyond the settings screen itself. The proxy header that reveals a visitor's real address behind a CDN is off by default for the same reason in reverse: any visitor can send an X-Forwarded-For header, so trusting it by default would let an attacker fake a clean address and never see the same counter twice.

Moving the login address works by intercepting the request rather than rewriting wp-login.php, and every WordPress function that prints a login link, wp_login_url() through to the links WordPress emails on password reset, is filtered to use the new address instead. Links already sent before the address changed, and password-protected post prompts, still go through wp-login.php itself, because they were generated before the new address existed and rewriting them retroactively is not possible.

Measured on the release zip: 25KB, 1,935 lines of PHP including the settings-screen code shared across every Pantry plugin. Three options in the database: the settings, the 50-entry log, and a version marker; no custom tables, no post meta, no cron events and no post types. Four families of transients hold the counters and lockouts, all self-expiring. Admin assets, the shared Pantry CSS and JS, load only on the plugin's own settings screen. The only thing that reaches the front end is one inline style block on the login page, and only when a logo has been set; there is no other script or stylesheet on the front end, and the plugin makes no external request of any kind.

What it does not do, and who should stay with the big plugin

Pantry Login has no two-factor authentication, no CAPTCHA, no IP allow or deny lists, and no country blocking, and none of that is coming to the free plugin later; two-factor authentication and IP lists are on Pantry's own paid-add-on plan, which is a separate product rather than a feature switched on inside this one. A site that wants two-factor authentication today without waiting has real free options: Wordfence includes it in its free tier already, as does Limit Login Attempts Security, and Kadence Security (formerly Solid Security, formerly iThemes Security, at the better-wp-security slug) builds its free tier specifically around two-factor authentication and password-strength enforcement rather than a firewall.

A site that wants country blocking should use Loginizer Premium, Limit Login Attempts Security's Premium add-on or Wordfence Premium, all three of which sell it as a setting. A site that wants IP allow and deny lists, useful for an agency that only ever logs in from a short list of office and home addresses, should use Limit Login Attempts Security, which includes that free.

A site that is also worried about malware in its theme or plugin files, or wants a web application firewall in front of the whole site rather than just the login form, needs a different category of product entirely; Wordfence is built for exactly that, and login protection there is a side benefit of a much larger scan-and-firewall job. Pantry Login has no opinion on file integrity or firewalling and never will.

Moving over

Coming from Limit Login Attempts Security or Loginizer, the lockout settings map directly: attempts allowed, the counting window and the lockout length mean the same thing under different labels, so the numbers can simply be retyped into Pantry Login's settings screen. Neither plugin's log carries across; each stores it in its own option or table and in its own format, and Pantry Login starts a fresh log from activation. Two-factor secrets, IP allow and deny lists, and any Premium settings such as country blocking or reCAPTCHA keys have no equivalent field in Pantry Login and are simply left behind if you decide those features are not worth keeping.

Coming from WPS Hide Login, the custom address itself can be reused: whatever path segment sits after the domain in the old plugin's setting can be typed straight into Pantry Login's Address field, so bookmarks and password managers that already point at it keep working. Save the settings screen before logging out either way, since a wrong or forgotten address locks out every account until wp-config.php is edited to switch it off again.

Coming from Wordfence, only the login-limiting piece is relevant; there is no setting in Pantry Login that reads or imports anything from Wordfence's firewall, scanner or two-factor configuration, and switching does not touch any of it. Deactivate whichever plugin was handling login lockouts before turning Pantry Login's lockout on, since two plugins counting the same failed attempts independently produces two different lockout clocks for the same address. If a login-page-hiding plugin is also active elsewhere, turn off its redirect before switching Pantry Login's on, so the two are never both trying to serve the login form at once.

The short version

Pantry Login does the two jobs a login-security setting usually needs: throttle failed attempts, and move the form off the address every scanner already knows. It does not do two-factor authentication, CAPTCHA, IP lists or country blocking, and it will not gain any of that in the free plugin. For a site that wants exactly those two jobs done and nothing else to configure, that is the whole requirement. For a site that also wants two-factor logins, IP allow-listing, country blocking or a firewall, Limit Login Attempts Security, Loginizer, Wordfence and Kadence Security already build for that, several of them for free.

Measure	Pantry Login
Zip size	25KB
Lines of PHP	1,935
Options	3 (settings, 50-entry log, version)
Custom tables	0
Front-end assets	one inline style block, only when a logo is set
External requests	none
Tracking	none
Locked features	none