Settings reference

The main settings, grouped by screen. Defaults are what a fresh install has before Apply recommended. General Settings is one scrollable page with a shared Save button. Section names below are headings on that page, not separate sidebar destinations.

General → Core Security

Setting	Default	See
Block XML-RPC requests	Off	Core security
Block application passwords	Off	Core security
Hide usernames from the public	Off	Core security
Verify email addresses on signup	On	Core security

Setting	Default	See
Block an IP address after … failed attempts	5	Limit login attempts
within … minutes	30	Limit login attempts

General → Passkeys

Setting	Default	See
Allow passkeys	Off	Passkeys
Let people sign in with a passkey	Off	Passkeys
Roles that can set one up	None; every role when direct passkey sign-in is on	Passkeys

General → Two-Factor Authentication

Setting	Default	See
Email code	Off	Two-factor
Email Code → Roles that get the code	Administrator, Editor, Author	Two-factor
Authenticator app	Off	Two-factor
Authenticator App → Roles allowed to set one up	None	Two-factor
Make it required → Roles it is required for	None	Two-factor
What they can use	A passkey or the authenticator app only	Two-factor

Setting	Default	See
Enable magic login	Off	Magic login
Roles that cannot use it	None	Magic login
Show the link form first	Off	Magic login

General → Notifications

Setting	Default	See
Tell me when these roles sign in	None	Notifications
Tell me when someone is blocked	Off	Notifications
Send them to	`{admin_email}`	Notifications
Summary report	Monthly, on the 1st	Notifications

General → Visitor IP

Setting	Default	See
Trusted proxies	None	Core security
Header your proxy puts the visitor’s address in	`X-Forwarded-For`	Core security

General → Advanced

Setting	Default	See
Delete logs older than … days	30	Audit logs

| Keep these roles out of wp-admin | Subscriber preselected; restriction activates when saved | Core security |

2FA Enrollment

A list, not settings: every eligible user and their enrolled device methods, with a per-user reset. Two-factor.

IP Access Rules

Setting	Default	See
Blocked addresses	Empty	IP access rules
Allowed addresses	Empty	IP access rules
Restricted roles	None	IP access rules

Setting	Default	See
Social login	Off	Social login
Google: enabled, credential storage, client ID, client secret, One-Tap	Off	Login with Google, Google One-Tap
GitHub: enabled, credential storage, client ID, client secret	Off	Login with GitHub
Facebook: enabled, credential storage, client ID, client secret, API version	Off	Login with Facebook

Setting	Default	See
Shortcode forms	Off	Shortcodes
Login page design: enabled, side panel and form settings per page	Off	Login page designer

Setting	Default	See
Custom redirects	Off	Login redirects
Everyone → After signing in / After signing out	Empty	Login redirects
Rules	None	Login redirects

System Emails

Setting	Default	See
Each account email: status, subject, body	WordPress default	System emails
Template: logo, colours, font, footer, from and reply-to	Plain	System emails

Security → Monitoring

Setting	Default	See
Scheduled scanning	Off	File integrity
Scan interval	Daily	File integrity
Registered mode	Off	File integrity

Where settings are stored

All settings are rows in wp_options: __fls_auth_settings, __fls_social_auth_settings, __fls_auth_forms_settings, __fls_auth_customizer_settings, fa_system_email_settings, __fls_integrity_settings and __fls_auth_ip_rules. Logs are in their own tables; see Audit logs.

Something wrong or missing on this page?Open an issue on GitHub ↗

General → Core Security

General → Login Security