fluentAuth
★ 4.0 · 10k+ installsGet FluentAuth
Docs / Getting started

Installation

Install FluentAuth from the WordPress dashboard, WP-CLI or a zip file, and find its admin menu.

All documentation
Getting started
IntroductionInstallationGuided setupFirst-day setupThe dashboard
Login security
Limit login attemptsTwo-factor authenticationPasskeysIP access rulesCore security settings
Passwordless & social login
Magic loginSocial loginLogin with GoogleLogin with GitHubLogin with FacebookGoogle One-Tap
Forms & redirects
ShortcodesLogin redirectsLogin page designerSystem emails
Monitoring & recovery
Audit logsNotifications and digestsFile integrity scanningSecurity findingsRecovery after a compromise
Reference
Settings referenceHooks and filtersConstantsRemote auth (server mode)Troubleshooting

FluentAuth is in the WordPress.org plugin directory under the slug fluent-security. That name is historical; the plugin has been called FluentAuth since its first release.

From the dashboard

  1. In your WordPress admin, open Plugins → Add New.
  2. Search for FluentAuth.
  3. Click Install Now, then Activate.

A FluentAuth item appears near the bottom of the admin menu.

With WP-CLI

wp plugin install fluent-security --activate

The same command in a provisioning script gives every new site the plugin from day one.

Manual upload

  1. Download the zip from WordPress.org or a release on GitHub.
  2. Open Plugins → Add New → Upload Plugin and choose the file.
  3. Click Install Now, then Activate.

What activation does

  • Creates two tables, {prefix}fls_auth_logs for the audit log and {prefix}fls_login_hashes for magic-login and verification tokens.
  • Schedules a daily and an hourly maintenance event through WP-Cron, for log retention, digest emails and integrity scans.
  • Registers the fluent-auth REST namespace that the admin app talks to.

It does not change any WordPress setting until you save one. Activating the plugin on its own turns on nothing.

Updating

Updates arrive through the normal WordPress plugin updater. Settings and logs are kept across updates; the changelog on WordPress.org calls out anything that needs attention.

Uninstalling

Deactivating the plugin removes its hooks immediately, so two-factor prompts, attempt limits and redirects stop at once. Deleting it removes the plugin files. The two log tables are left in place so an accidental delete does not lose your history; drop them yourself if you want them gone.

CARE

If you enforce two-factor for administrators and need to switch it off in a hurry, deactivate the plugin rather than editing the database. The troubleshooting page lists the constants that disable individual modules from wp-config.php.

Next: First-day setup.