Active installationsNewAdoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records LyoGate — Login Security version 1.1.0 as active, updated 17d ago and tested up to WordPress 7.1.
Overview
About this plugin
LyoGate replaces the default WordPress login page with a modern, protected one. Everything is configured from Settings → LyoGate. No external accounts, no third-party services: everything runs on your own site.
Security
Arithmetic captcha — a simple sum is required before signing in, backed by an HMAC-signed token with expiry (10 minutes): the answer never travels in clear text and is never stored in the database.
Per-IP brute-force lockout — after N failed attempts (default 5) the IP address is locked out for X minutes (default 15). Wrong captcha and honeypot hits count too; a successful login resets the counter. The lockout applies even with correct credentials.
Honeypot — a field hidden from humans: whoever fills it in is a bot and gets rejected without hints.
Unified error messages — no username enumeration: “unknown user” and “wrong password” produce the same generic message.
Reduced attack surface — XML-RPC disabled, X-Pingback header removed, public REST user endpoints removed (they remain available to users who can edit posts, for the block editor), and?author=N requests plus author archives redirect to the home page: no username scraping.
Customizable appearance
Title, subtitle and footer message
Custom logo from the media library, with a configurable clickable link (empty = site home)
Two Google Fonts to choose from: Syne, Instrument Sans, Inter, Space Grotesk, Manrope, DM Sans, Outfit, Sora, Archivo, Playfair Display and JetBrains Mono (one for headings, one for body text)
Three colors: background, text and accent (buttons and focus)
Compatibility
The security gate runs as a late filter on the authenticate flow: captcha and lockout always take precedence over valid credentials. The gate only acts on the wp-login.php form: XML-RPC is disabled entirely while LyoGate is active, and application password / REST requests follow the normal WordPress flow (should another plugin re-enable XML-RPC, its authentication is not intercepted by the captcha).
All settings live in a single database option; on uninstall, options and transients are removed (also on multi-site).
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
brute force
custom login
captcha
security
Compatibility & maintenance
Compatibility & maintenance
Tested with WP 7.1
Marked as tested with the current WordPress 7.1 release.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to7.1
Minimum requirementsWordPress 6.0 · PHP 8.0
Update activity16 Oct 202617d ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
Version1.0.0→1.1.0
WordPress compatibility7.1.2→7.1.3
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
