fluentAuth
★ 4.0 · 10k+ installsGet FluentAuth
Docs / Reference

Settings reference

Every setting in FluentAuth, grouped by screen, with its default and the page that explains it.

All documentation
Getting started
IntroductionInstallationGuided setupFirst-day setupThe dashboard
Login security
Limit login attemptsTwo-factor authenticationPasskeysIP access rulesCore security settings
Passwordless & social login
Magic loginSocial loginLogin with GoogleLogin with GitHubLogin with FacebookGoogle One-Tap
Forms & redirects
ShortcodesLogin redirectsLogin page designerSystem emails
Monitoring & recovery
Audit logsNotifications and digestsFile integrity scanningSecurity findingsRecovery after a compromise
Reference
Settings referenceHooks and filtersConstantsRemote auth (server mode)Troubleshooting

Every switch and field the plugin has, in the order the settings screens show them. Defaults are what a fresh install has before Apply recommended settings.

General → Core Security

SettingDefaultSee
Block XML-RPC requestsOffCore security
Block application passwordsOffCore security
Hide usernames from the publicOffCore security
Verify email addresses on signupOffCore security
Keep these roles out of wp-adminOff; roles: SubscriberCore security

General → Login Security

SettingDefaultSee
Maximum failed attempts5Limit login attempts
Within (minutes)30Limit login attempts

General → Two-Factor Auth

SettingDefaultSee
Email codeOffTwo-factor
Email code rolesAdministrator, Editor, AuthorTwo-factor
Passkey (3.0)Off; no rolesPasskeys
Authenticator appOffTwo-factor
Authenticator rolesNoneTwo-factor
Authenticator required forNoneTwo-factor

General → Magic Login

SettingDefaultSee
Magic loginOffMagic login
Not for these rolesNoneMagic login
Make it the primary methodOffMagic login

General → Notifications

SettingDefaultSee
Email me when these roles sign inAdministrator, Editor, AuthorNotifications
Email me when someone is blockedOnNotifications
Send to{admin_email}Notifications
Summary emailOffNotifications

General → Visitor IP

SettingDefaultSee
Trusted proxiesNoneCore security
Proxy IP headerX-Forwarded-ForCore security

General → Advanced

SettingDefaultSee
Automatically delete logs older than (days)30Audit logs

2FA Enrollment

A list, not settings: every eligible user and their enrolled device methods, with a per-user reset. Two-factor.

IP Access Rules

SettingDefaultSee
Block listEmptyIP access rules
Allow listEmptyIP access rules
Restrict these roles to allow-listed addressesNoneIP access rules

Social Login

SettingDefaultSee
Enable social login / signupOffSocial login
Google: enabled, credential storage, client ID, client secret, One-TapOffLogin with Google, Google One-Tap
GitHub: enabled, credential storage, client ID, client secretOffLogin with GitHub
Facebook: enabled, credential storage, client ID, client secret, API versionOffLogin with Facebook

Login & Signup Forms

SettingDefaultSee
Enable custom auth formsOffShortcodes
Login page design: enabled, banner and form settings per pageOffLogin page designer

Login Redirects

SettingDefaultSee
Enable custom login redirectsOffLogin redirects
Default login redirect URL, default logout redirect URLEmptyLogin redirects
RulesNoneLogin redirects

System Emails

SettingDefaultSee
Each of the eight emails: status, subject, bodyWordPress defaultSystem emails
Template: logo, colours, font, footer, from and reply-toPlainSystem emails

Security → Monitoring

SettingDefaultSee
Scheduled scanningOffFile integrity
Scan intervalDailyFile integrity
Registered modeOffFile integrity

Where settings are stored

All settings are rows in wp_options: __fls_auth_settings, __fls_social_auth_settings, __fls_auth_forms_settings, __fls_auth_customizer_settings, fa_system_email_settings, __fls_integrity_settings and __fls_auth_ip_rules. Logs are in their own tables; see Audit logs.