=== All In One Login ===
Contributors: wpexpertsio
Tags: login url, login security, custom login, 2fa, recaptcha
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.5.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Secure and customize your WordPress login page with a custom login URL, 2FA, CAPTCHA, and more.

== Description ==

= WordPress Login Page Plugin =
All In One Login helps you protect and customize your WordPress login experience. Change the login URL, add Email 2FA or Email OTP, block or allow IPs, review activity logs, and style the login page with templates.

[Documentation](https://aiologin.com/docs/?utm_source=wp_org&utm_medium=readme&utm_campaign=docs) | [Pro features](https://aiologin.com/pricing/?utm_source=wp_org&utm_medium=readme&utm_campaign=pricing)

https://youtu.be/kDWrQNvZO0s?si=OL1hbiZXC0AD0S3t

Looking for a one-stop solution to secure and customize your WordPress login page **(wp-login.php)?** If that’s what you need, you're in the right place.

Over **60,000 website owners** use All In One Login to secure and customize their WordPress login pages. 🎉

**The reason is obvious!** 👇
All In One Login is a complete WordPress login security plugin that helps you secure and customize your WordPress login page with security features and customization options. 🤯

From changing the WordPress login URL to integrating Google reCAPTCHA, All In One Login offers features to help protect and customize your WP login page.
Isn’t that amazing? Wait until you see its amazing features! 😃 👇


==Key Features Our Users Love About All In One Login (Free + Pro)==
The All in One Login plugin includes all the essential features that ensure the best WordPress login protection and customization.


= Free Version Includes the Following Features: 👇 =

* **Wp-login.php URL Customization** 
Secure your site by changing the default wp-login.php URL. Hide the WordPress login page from hackers and prevent unauthorized access with a simple custom login URL

* **Google reCAPTCHA** 
Protect your WordPress login page from spam and bots. Add Google reCAPTCHA v2 or v3 to your WP-Admin for secure authentication and reduce automated login attempts.

* **Login and Logout Redirection**
Control where users are redirected after login and logout by creating custom redirection rules for all users, user roles, or specific users.

* **Login Page Customizer** 
Transform your WordPress login page with live preview customization. Change logos, colors, backgrounds, and layouts without coding.

* **User Enumeration Protection**
Block attackers from discovering WordPress usernames through author or query string requests. This prevents exposure of valid usernames and strengthens login security against brute-force attacks.

* **Login Security Dashboard** 
Manage your login security settings from a centralized dashboard. View recent successful and failed login attempts, monitor locked-out IP addresses, and access features such as custom login URLs, limit login attempts, two-factor authentication (2FA), and IP blocking.

* **Email OTP Login** 
Allow users to sign in securely using a one-time verification code sent to their email address. This provides a passwordless login experience while reducing the risks associated with weak or compromised passwords.

* **Login Activity Logs**
Keep track of all login attempts and activity logs for enhanced security monitoring. See the username, IP address, date, time, lockout list, and more.

* **Disable Common Usernames**
Block weak or predictable usernames to improve WordPress login security. Force unique usernames and prevent attackers from exploiting common entries on your WordPress site.

* **Ban User/IP Address**
Block unwanted users or IP addresses instantly. Restrict access to your WordPress login page and protect WP-Admin from hackers using this IP and user ban plugin.

* **Whitelist IP Addresses**
Allow only trusted IP addresses to access your WordPress login page. Restrict WP-Admin access to selected users, adding an extra security layer to your site.

* **Email-Based 2FA**
Add an extra security layer with email one-time passwords (OTP). Users receive a 6-digit verification code via email during login, no authenticator app required.

= ✨Pro Version Unlocks (everything in Free, plus): =

* **2FA Backup Codes & Grace Period**
Never get locked out! Generate one-time backup codes and set grace periods for a smooth 2FA rollout across your user base.

* **Slack Security Notifications**
Receive real-time WordPress security alerts directly in Slack. Monitor failed logins, IP lockouts, and suspicious activity.

* **Webhook Notifications**
Connect with Zapier, Make, n8n, or custom APIs. Send security events to HTTPS endpoints for automated monitoring and workflows.

* **Login Templates**
Choose from professionally designed login page templates. Apply modern, minimalist, or professional designs instantly.

* **Google Fonts Integration**
Access over 1,900 Google Fonts to match your login page typography with your brand. Customize fonts across all login elements.

* **WooCommerce Login Integration**
Enable social login and passwordless Login Links on WooCommerce account and checkout pages. Support Google, Facebook, Apple, Discord, Microsoft, and LINE.

* **Social Login Integration**
Allow users to sign in with Google, Facebook, Microsoft, or LINE. Simplify WordPress and WooCommerce registration while improving the login experience.

* **hCaptcha**
Protect your WordPress login page from bots and spam with privacy-focused, enterprise-grade verification that helps keep user data secure.

* **App-Based 2FA**
Add two-factor authentication to WordPress login. Protect WP-Admin by ensuring that users verify their identity before accessing your site.

* **Temporary Login URLs (Passwordless Login)**
Generate temporary login URLs for specific users. Control link expiration and the number of visits to provide secure, short-term access without sharing passwords.

* **Password Strength Checker**
Enforce strong WordPress passwords by setting minimum length, character requirements, and uppercase and lowercase rules to improve login security.

* **Limit Login Attempts**
Prevent brute-force attacks by limiting failed login attempts. Lock out users after repeated failures to protect your WordPress login page.

* **SMS OTP Login**
Allow users to authenticate using one-time verification codes sent by SMS through Twilio integration for a secure, passwordless login experience.

* **Login Link (Magic Link)**
Let users sign in using a secure, one-click link sent to their email. Simplify authentication and reduce login and checkout friction.

* **User Enumeration Logs**
Track attempts to discover WordPress usernames. Review recorded activity to identify suspicious behavior and investigate potential security threats.

* **5+ Social Login Options**
Allow users to sign in using existing social accounts, including Google, Facebook, Microsoft, LINE, GitHub, Apple, and Discord.

* **Google Social Login**
Let users sign in with their Google accounts for faster registration and a simpler login experience.

* **Facebook Social Login**
Enable familiar Facebook authentication to simplify user onboarding and reduce registration friction.

* **Microsoft Social Login**
Provide secure Microsoft authentication for business and education-focused websites, making login easier for users who already use Microsoft services.

* **GitHub Social Login**
Allow developers and technology professionals to sign in with their GitHub accounts, making it ideal for developer communities and technical websites.

* **Apple Social Login**
Offer Sign in with Apple for convenient, privacy-focused authentication, allowing users to protect their email addresses.

* **Discord Social Login**
Allow Discord users to sign in with one click. Ideal for gaming communities, creator platforms, and community-driven websites.

* **LINE Social Login**
Enable LINE authentication for websites targeting audiences in regions where LINE is widely used.

==WordPress Multisite Network Compatibility==

* **WordPress Multisite Support**
Manage login security and customization across your WordPress Multisite network. Use supported login protection and customization features to help secure access to your network’s websites.

==Why Choose All In One Login for WordPress Login Security and Customization? 👇==

* **WordPress Login Security**
Change your login URL, block unwanted users and IP addresses, and restrict login access to trusted IP addresses.

* **Brute-Force Protection**
Limit failed login attempts and help prevent automated login attacks.

* **Login Page Customization**
Customize your WordPress login page with templates, logos, backgrounds, colors, and fonts.

* **Bot Protection**
Integrate Google reCAPTCHA or hCaptcha to help protect your login page against bots and automated attacks.

* **Login Activity Monitoring**
Monitor login attempts, IP addresses, lockouts, and user enumeration events to identify suspicious activity.

* **Two-Factor Authentication (2FA)**
Add email-based or authenticator app verification, with backup codes and additional access controls.

* **Passwordless Login**
Let users sign in using email OTPs, SMS OTPs, temporary login URLs, or one-click login links.

* **Social Login**
Allow users to sign in using supported providers, including Google, Facebook, Microsoft, GitHub, Apple, Discord, and LINE.

* **Login and Logout Redirection**
Redirect users to specific pages after login or logout based on their roles or individual accounts.

* **Security Notifications**
Receive security alerts through Slack or external services using webhooks.

* **WooCommerce Login Integration**
Enable supported social login and passwordless authentication options on WooCommerce account and checkout pages.

* **WordPress Multisite Compatibility**
Apply supported login security and customization features across your WordPress Multisite network.

* **Password Policy Controls**
Configure password strength requirements to help users create stronger and more secure passwords.

== External Services ==

= Third-Party Services We Use =

All In One Login connects to third-party services to provide optional features. These services may process certain information when you enable and use the related features. Services marked “Pro plugin only” are used only when the separate AIO Login Pro plugin is installed and the related feature is enabled.

* **Google reCAPTCHA**

Helps protect your WordPress login page from bots and automated login attempts. When enabled, Google may process your IP address, browser information, and verification data.

Service: [Google reCAPTCHA](https://cloud.google.com/security/products/recaptcha)

Privacy Policy: [Google Privacy Policy](https://policies.google.com/privacy)

Terms of Service: [Google Terms of Service](https://policies.google.com/terms)

* **hCaptcha** (Pro plugin only)

Helps detect bots and automated activity on your WordPress login page when enabled in AIO Login Pro. When enabled, the Pro plugin communicates with hCaptcha to verify user interactions.

Service: [hCaptcha](https://www.hcaptcha.com/)

Privacy Policy: [hCaptcha Privacy Policy](https://www.hcaptcha.com/privacy)

Terms of Service: [hCaptcha Terms of Service](https://www.hcaptcha.com/terms)

* **Cloudflare Turnstile**

Optional CAPTCHA alternative used when an administrator enables Cloudflare Turnstile (for example with passwordless or magic-link login features). When enabled, the visitor’s browser loads scripts from challenges.cloudflare.com and Cloudflare may process technical data such as IP address and browser information to verify the interaction.

Service: [Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/)

Privacy Policy: [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/)

Terms of Service: [Cloudflare Terms of Service](https://www.cloudflare.com/website-terms/)

* **Google Fonts**

Provides additional fonts for login page customization. When fonts load from Google’s servers, the visitor’s browser may share technical information, such as their IP address.

Service: [Google Fonts](https://fonts.google.com/)

Privacy Policy: [Google Privacy Policy](https://policies.google.com/privacy)

Terms of Service: [Google Terms of Service](https://policies.google.com/terms)

* **Twilio** (Pro plugin only)

Delivers SMS verification codes when an administrator enables and configures SMS OTP login in AIO Login Pro. Information shared with Twilio may include the recipient’s phone number and the message content required to deliver the code.

Service: [Twilio](https://www.twilio.com/)

Privacy Policy: [Twilio Privacy Policy](https://www.twilio.com/en-us/legal/privacy)

Terms of Service: [Twilio Terms of Service](https://www.twilio.com/en-us/legal/tos)

* **Social Login Providers** (Pro plugin only)

With AIO Login Pro, social authentication is available through Google, Facebook, Microsoft, GitHub, Apple, Discord, and LINE. When a user selects a provider, the Pro plugin communicates with that service to authenticate the user and process the information required for login.

- Google — [Privacy](https://policies.google.com/privacy) · [Terms](https://policies.google.com/terms)
- Facebook — [Privacy](https://www.facebook.com/privacy/policy/) · [Terms](https://www.facebook.com/terms)
- Microsoft — [Privacy](https://privacy.microsoft.com/) · [Terms](https://www.microsoft.com/servicesagreement)
- GitHub — [Privacy](https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement) · [Terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service)
- Apple — [Privacy](https://www.apple.com/legal/privacy/) · [Terms](https://www.apple.com/legal/internet-services/terms/site.html)
- Discord — [Privacy](https://discord.com/privacy) · [Terms](https://discord.com/terms)
- LINE — [Privacy](https://line.me/en/terms/policy/) · [Terms](https://terms.line.me/line_terms)

* **ipapi.co** (Pro plugin only)

Used by AIO Login Pro for optional IP geolocation (for example activity or security displays). When used, the visitor or admin IP may be sent to ipapi.co to resolve approximate location data.

Service: [ipapi.co](https://ipapi.co/)

Privacy Policy: [ipapi.co Privacy](https://ipapi.co/privacy/)

Terms of Service: [ipapi.co Terms](https://ipapi.co/terms/)

* **Freemius**

Supports optional admin email opt-in and licensing-related services for this plugin. When an administrator consents to the Freemius opt-in prompt, Freemius may receive the admin email address, site URL, and basic environment/plugin metadata needed for the opt-in and account services. No opt-in data is sent without that consent. Freemius premium remote install is disabled for the WordPress.org build.

Service: [Freemius](https://freemius.com/)

Privacy Policy: [Freemius Privacy Policy](https://freemius.com/privacy/)

Terms of Service: [Freemius Terms of Service](https://freemius.com/terms/)

= Privacy Policy =

All In One Login may process information when you use its features or connect to third-party services. For more information about how we collect, use, and handle data, please read our [All In One Login Privacy Policy](https://aiologin.com/privacy-policy/).

== Other Plugins by Us ==

* [**Password Protected**](https://wordpress.org/plugins/password-protected/): Protect your WordPress site, posts, pages, and categories with password protection.
* [**Post SMTP**](https://wordpress.org/plugins/post-smtp/): Configure and manage WordPress email delivery with SMTP and detailed email logs.
* [**New User Approve**](https://wordpress.org/plugins/new-user-approve/): Manage user registrations by approving or denying new signups.

== Technical Documentation ==

Visit our [All In One Login Documentation](https://aiologin.com/docs/) for step-by-step instructions on securing and customizing your WordPress login page.

== Need Help? Get Expert Assistance ==

Need help securing or customizing your WordPress login page? Our support team is ready to answer your questions and help you get the most out of All In One Login.

[**Open a Support Ticket**](https://objectsws.atlassian.net/servicedesk/customer/portal/35/group/105/create/362) to get assistance with any issues.

== Frequently Asked Questions ==

= What is All In One Login? =

All In One Login is a WordPress login security and customization plugin that helps protect your website from unauthorized access. It includes features such as custom login URLs, brute-force protection, two-factor authentication, passwordless login, social login, and login page customization.

= Can I receive security alerts in Slack? =

Yes. All In One Login Pro sends security alerts to your Slack workspace for events such as failed login attempts, IP lockouts, and suspicious activity.

= Does All In One Login support webhooks? =

Yes. All In One Login Pro lets you send security events to HTTPS endpoints and connect with automation tools such as Zapier, Make, n8n, and custom APIs.

= What happens if I lose access to my two-factor authentication method? =

All In One Login Pro supports one-time backup codes that you can use to regain access when your primary two-factor authentication method is unavailable.

= Can I change the default WordPress login URL? =

Yes. All In One Login lets you customize the default WordPress login URL to make your login page less predictable and help reduce unwanted login attempts.

= Which social login providers does All In One Login support? =

All In One Login Pro supports Google, Facebook, Microsoft, GitHub, Apple, Discord, and LINE, allowing users to sign in with their existing accounts.

= Can I enable passwordless login on my WordPress site? =

Yes. All In One Login supports passwordless login through email OTP. Pro adds SMS OTP, temporary login URLs, and one-click email login links, giving users convenient alternatives to traditional passwords.

= How does All In One Login handle security vulnerability reports? =

We take security seriously. If you discover a potential vulnerability in All In One Login, please report it through our [Patchstack Vulnerability Disclosure Program](https://patchstack.com/database/vdp/9e5fb882-a208-4e32-a495-da1d8f98c036). Patchstack helps verify reports and coordinate responsible disclosure with our development team.

= Does All In One Login support WordPress Multisite? =

Yes. All In One Login supports WordPress Multisite, allowing you to use supported login security and customization features across your multisite network.

= What is the difference between All In One Login Free and Pro? =

Free includes login URL customization, Google reCAPTCHA, login activity logs, email OTP login, and other essential login security features. Pro adds advanced access controls, additional two-factor authentication methods, social login integrations, security notifications, and passwordless login options.

= Can I restrict WordPress login access by IP address? =

Yes. All In One Login Free includes IP blacklist and whitelist controls for the login page. Pro adds related advanced access features such as Limit Login Attempts lockouts and additional security tooling.

= Can I temporarily give someone access to my WordPress site without sharing a password? =

Yes. All In One Login Pro supports temporary login URLs that let you grant access without sharing passwords. You can configure link expiration and access limits for temporary access.

= Does All In One Login protect against user enumeration? =

Yes. All In One Login includes user enumeration protection to help prevent visitors from discovering WordPress usernames through supported author and query string requests. Pro also includes user enumeration logs to help administrators review recorded activity.

= Where can I find documentation and support for All In One Login? =

Visit the [All In One Login website](https://aiologin.com/) to find plugin information, documentation, and support resources.

== Screenshots ==

1. Login Security Dashboard
2. Custom Login URL Settings
3. Google reCAPTCHA Setup
4. Login and Logout Redirection
5. Login Page Customization
6. Login Activity Logs
7. Email OTP Login
8. User Enumeration Protection
9. Disable Common Usernames
10. Blacklist/Whitelist IP Addresses
12. Email-Based Two-Factor Authentication (2FA)

== Changelog ==
= 2.5.1 – Oct 30, 2026 =
* WordPress.org compliance and Plugin Check cleanup.
* Harden 2FA settings REST, OTP anti-enumeration, and admin email localization.
* Safer Free uninstall (no Pro option wipe); SSL verify on redirect URL checks.
* Pair-guard notice dismiss persistence; network settings scripts extracted from HEREDOC.
* Show AIO Login Customize panel under Appearance → Customize.
* Move Login Redirection Order UI/logic to Pro; Free no longer ships Order feature code.
* Readme external services, Free/Pro IP docs, and packaging metadata updates.

= 2.5.0 – Oct 26, 2026 =

* NEW: Added WordPress Multisite support.
* NEW: Added Email-Based Two-Factor Authentication (2FA) for enhanced login security.
* NEW: Added IP Blacklisting and Whitelisting to block unwanted IP addresses and allow trusted IP addresses.
* NEW: Added the Disable Common Usernames feature to prevent the use of weak and predictable WordPress usernames.
* Security Fix: Fixed an unauthenticated account takeover vulnerability related to Email OTP login.
* Improvement: Updated Freemius SDK to version 2.13.4.
* Fix: Removed bundled jQuery to improve compatibility with WordPress core.
* Fix: Fixed internationalization (i18n), text domain, and gettext issues.
* Fix: Improved Customizer sanitization callbacks.
* Fix: Removed HEREDOC usage.
* Fix: Prevented direct loading of the WordPress core `template-loader.php` file.


= 2.4.1 – Aug 18, 2026 =
* Fix – Email OTP was enabled by default.
* Fix – Fixed an unauthenticated account takeover vulnerability through Email OTP login in AIO Login 2.4.0.
* Fix – Fixed the translation issue with the “Email me an OTP” text for multilingual websites.

= 2.4.0 – June 23, 2026 =
* NEW – Introduced Passwordless Authentication with support for Email OTP Login, SMS OTP Login, and Login Link (Magic Link).
* NEW – Added Email OTP Login, enabling users to securely sign in using a one-time code sent to their email.
* FIX – Resolved dashboard responsiveness issues.

= 2.3.1 - June 12, 2026 =
* New – Added an admin notice

= 2.3.0 – June 08, 2026 =
* NEW – Introduced Login Redirection, allowing users to create personalized login and logout redirection rules.
* FIX – Resolved a CSS issue affecting the WordPress login page.
* FIX – Resolved a PHP warning related to the Template Grid customization control when rendering login customization templates.

= 2.2.0 – May 01, 2026 = 
* New – Introduced Real-Time Customizer for login form customization.
* Tweak – Added the Pro screen of Discord and GitHub in Social Login.
* Tweak – Added tooltip content for all plugin features. 
* Tweak – Added 2FA tab in plugin navigation.  
* Tweak –  Added backward compatibility for the old Customizer.  
* Tweak – Added Notifications sub-tab in Activity Logs.  


= 2.1.1 – Jan 21, 2026 = 
* Tweak – Added new tab of Integration and WooCommerce integration pro screen.
* Tweak – Added the hCaptcha Pro screen in the Captcha tab.

= 2.1.0 – Oct 15, 2025 =
* New – Added User Enumeration Feature 
* Tweak – Added pro screen of User Enumeration logs in Activity logs 

= 2.0.10 - Oct 06, 2025 =
* Tweak - Separated Social Login in navigation and added Pro banner.
* Improvement - Revamped Google reCAPTCHA and restructured it into a multi-step format.

= 2.0.9 - Aug 26, 2025 =
* Security – Enhanced login protection to better defend against repeated failed login attempts and brute-force attacks.

= 2.0.8 May 21, 2025 =
* Updated feedback SDK to latest version.

= 2.0.7 Apr 21, 2025 =
* Fixed translation notice.
* Tested compatibility with latest WordPress (Version 6.8)

= 2.0.6 Mar 13, 2025 =
* Updated readme with a new feature.

= 2.0.3 Dec 02, 2024 =
* Updated backend with VueJS to improve UX

= 2.0.2 Nov 21, 2024 =
* Tested compatibility with latest WordPress (Version 6.7)
* Updated - Feedback SDK to latest Version

= 2.0.1 =
* New - Added multisite compatibility
* New - Added button to clear all failed & lockout logs
* Fix - Resolved php error for older versions

= 2.0.0 =
* Fixed - Forgot password link breaking.
* New - Improved the UI.
* New - Added new Dashboard
* New - Added Limit login Attempts feature
* New - Added activity logs for failed login attempts
* New - Added activity logs for lockout users
* New - Added Google reCAPTCHA functionality
* New - Added login page customization options

= 1.1.8 =
* Fixed: compatibility issues with WPForms, WordFence

= 1.1.7 =
* Fixed: Redirection to wp-admin when trying to access admin pages directly.

= 1.1.6 =
* Fixed: The recent commit has been reverted to address conflicts in various cases

= 1.1.5 =
* Fixed: Resolved the issue undefined is_user_logged_in() function error in certain cases.

= 1.1.4 =
* Fixed: Redirection to wp-admin when trying to access admin pages directly.

= 1.1.3 =
* Handover plugin

= 1.1.2 =
* More Fixes for php8 warnings

= 1.1.1 =
* Fix php8 warnings

= 1.1.0 =
* Update WordPress API settings

= 1.0.9 =
* fix security issue

= 1.0.8 =
* fix security issue

= 1.0.7 =
* fix missing register_setting on the add_settings_field

= 1.0.6 =
* fix suppressed warning

= 1.0.5 =
* add site URL before the new redirect input field

= 1.0.4 =
* Add redirect custom field.
* Better instructions in how to use the redirect field

= 1.0.3 =
* Add redirect custom field.
* When someone tries to access the wp-login.php page or the wp-admin directory while not logged in will be redirected to the page you defined on the redirect custom field.

= 1.0.2 =
* Add translations

= 1.0.1 =
* Add automatic redirect for when someone tries to access the wp-login.php page or the wp-admin directory while not logged in will be redirected to the website homepage.

= 1.0.0 =
* Initial version.