FluentAuth is a lightweight security plugin for WordPress. It covers the three jobs a security plugin has: preventing break-ins, detecting attempts, and recovering afterwards. It combines login protections, activity records and file comparison in one dashboard.
In practice that means limiting login attempts, two-factor authentication, passkeys, IP rules, core hardening, passwordless and social login, login redirects, an audit log, email alerts, file-integrity scans, a findings checklist and a post-hack recovery screen.
FluentAuth is GPL licensed and available at $0. The features shown on this site will remain in the free plugin if a Pro version is introduced. See pricing.
What it does, in one table
| Job | Where it lives | Docs |
|---|---|---|
| Limit failed logins per IP | Settings → General Settings → Login Security | Limit login attempts |
| Two-factor authentication | Settings → General Settings → Two-Factor Auth | Two-factor authentication |
| Magic login by email | Settings → General Settings → Magic Login | Magic login |
| Google, GitHub, Facebook login | Settings → Social Login | Social login |
| Redirect after login/logout | Settings → Login Redirects | Login redirects |
| Front-end login/signup forms | Settings → Login & Signup Forms | Shortcodes |
| Login page designer | Settings → Login & Signup Forms → Login Page Design | Login page designer |
| Rewrite WordPress account emails | Settings → System Emails | System emails |
| XML-RPC, usernames, app passwords, wp-admin access | Settings → General Settings → Core Security | Core security settings |
| Every login attempt, searchable | Logs | Audit logs |
| Emails when admins sign in, digests | Settings → General Settings → Notifications | Notifications |
| Core, plugin and theme file changes | Security → Monitoring | File integrity scanning |
What it deliberately does not do
- No web application firewall. Use your host or an edge firewall for that layer. FluentAuth handles login protections and file monitoring. Declare trusted proxies so address-based rules can identify visitors correctly.
- No malware scanner running on page load. The integrity scanner runs on a schedule, in the background, against the official copies of your files.
- No hidden login URL. The real login page is made safe instead; see the FAQ for why.
- Included features. Everything described here is included in the $0 plugin.
Requirements
| Requirement | Value |
|---|---|
| WordPress | 5.0 or later (tested up to 6.9) |
| PHP | 7.3 or later |
| Storage | Login logs and temporary login tokens use dedicated tables; passkey public credentials are stored separately |
| Outbound connections | Official file references during scans; enabled social providers; configured email delivery; optional scan alerts service |
Logs live in their own tables so they never grow wp_options or wp_postmeta, and the
retention setting purges them on a schedule.
Where to next
- Install the plugin and open its Dashboard.
- Follow First-day setup: apply the recommended settings and turn on two-factor for administrators. Ten minutes.
- Read the page for any feature you switch on. Each one lists every setting and what it changes.
These docs describe FluentAuth 3.0.0. Screenshots are captured on a local development site. Features added in a particular version carry a release notice saying so.