Skip to content
Plugin PantryPlugins

Plugins / Pantry Login

Stop password guessing with a lockout after a few failed attempts, and move the login page to an address of your own. Errors stop revealing whether the username exists. Put your logo on the login form.

Compared with the popular plugins

The Pantry Login settings screen in the WordPress admin, at Plugin Pantry > Login.

What it does

  • Lock out an IP and username after a set number of failed attempts within a window, for a set number of minutes
  • Remaining-attempts message and a clear lockout message on the form
  • Lockout log of the last 50 events with a masked IP, username and time, stored in one option
  • Optional trust of a proxy header for the real IP, off by default
  • Custom login address, with wp-login.php and direct wp-admin access for visitors sent to a 404
  • Generic error message so the form never confirms a username
  • Login form logo with a link to the home page

What it does not do

  • No two-factor authentication
  • No CAPTCHA
  • No IP allow or deny lists
  • No country blocking
  • No external requests

Measured footprint

Zip size
27 KB
Lines of PHP
2,095
Options
pantry_login_settings, pantry_login_log, pantry_login_version
Post meta
none
Custom tables
none
Post types
none
Cron events
none
Transients
pantry_login_c_<md5 of address and username>, pantry_login_i_<md5 of address>, pantry_login_lp_<md5 of address and username>, pantry_login_li_<md5 of address>
Admin assets
includes/core/assets/pantry-admin.css on the settings screen only, includes/core/assets/pantry-admin.js on the settings screen only
Front-end assets
one inline style block on the login page, printed only when a logo is set
External requests
none
Measured on
2026-09-12

Compatibility

WordPress
6.4 or newer, tested to 7.1
PHP
8.1 or newer
Where it lives
Plugin Pantry > Login
Licence
GPLv2 or later

Documentation

Read the documentation

Every setting on the Pantry Login screen and what each one does, with the hooks it publishes: the same text that ships in the plugin README.

Pro add-on

See Pantry Pro pricing
  • Two-factor authentication with recovery codes
  • IP allow and deny lists
  • Login notifications
  • Cloudflare Turnstile

These modules ship in Pantry Pro now. None of this is in the free plugin, and none of it is switched off inside it: Pro is a separate plugin, and one key switches on every module whose free plugin is active.

Read the module documentation

Changelog

All notable changes to Pantry Login are recorded here. The format follows Keep a Changelog, and the project uses semantic versioning.

1.1.0 - 2026-09-12

  • Added the pantry_login_settings_after action, which fires at the end of the settings screen so an add-on can print its own section there.
  • Lockout::generic_message() is now public and static, so anything else that refuses a login can print the same words.
  • No change to how the plugin behaves.

1.0.0 - 2026-09-12

  • First release.
  • Lockout after a set number of failed attempts within a window, counted per address and per address and username together.
  • Remaining-attempts message and a lockout message with the time left, shown on the login form.
  • Lockout log of the last 50 events with a masked address, the username tried and the time, held in one option.
  • Buttons to release every recorded lockout and to clear the log.
  • Optional trust of the X-Forwarded-For header for sites behind a proxy, off by default.
  • Custom login address, with wp-login.php and wp-admin returning a 404 to logged-out visitors.
  • One generic error message so the form never confirms that a username exists.
  • Login form logo linked to the home page.
  • pantry_login_locked action and pantry_login_generic_message filter.