Login Security

🔐 Login Configuration

The Login tab lets you enable or disable the entire access security system and configure the core brute-force protection parameters: failed attempt limit, temporary block duration, conditions for permanent blocks, plus email notifications.

Configuration Parameters

Protection Flow

Detailed Behavior

• Temporary Block: Applied after exceeding the failed attempt limit. The IP is blocked for the configured time (default 15 min). When it expires, the IP regains access automatically.

• Permanent Block: Activated when an IP accumulates multiple temporary blocks (default 3). Requires manual administrator intervention to unblock.

🛡️ CAPTCHA

The CAPTCHA system protects your forms against bots and automated attacks. It offers 7 different verification modes to adapt to each site's needs.

Available CAPTCHA Modes

Forms to Protect

You can select which forms have CAPTCHA applied:

• Login: Protects the login form against brute force.

• Register: Prevents mass creation of fake accounts.

• Comments: Prevents automated spam in comments.

• Password Reset: Blocks password reset attacks.

Google reCAPTCHA Configuration

For modes using Google reCAPTCHA (v2, v3, Hybrid), you need to register your site at Google reCAPTCHA Admin and obtain the following keys:

Anti-Abuse Protection

🔑 Two-Factor Authentication (2FA)

Two-factor authentication adds an extra layer of security by requiring a second verification factor in addition to the password. The system supports TOTP (Time-based One-Time Password) via authenticator apps and email codes as an alternative.

Initial Activation by Admin

Before configuring global 2FA policies, the admin must activate 2FA on their own account. The system generates a QR code with the TOTP secret that must be scanned with an authenticator app (Google Authenticator, Authy, Microsoft Authenticator, etc.).

Global 2FA Policy

User Management

The admin panel allows searching users, resetting or disabling 2FA for specific accounts, and resending recovery codes. Includes statistics cards: Users with 2FA, Without 2FA, Policy status, Total users, and Email code status.

🚫 Anti Session Hijacking

Detects when a logged-in user suddenly switches country mid-session — the typical sign that someone has stolen their credentials or session cookie, for example after intercepting it on public or shared wifi. The system stores the country each user logs in from and compares it on every subsequent request.

Configuration Parameters

Action Modes

What are country ISO codes?

They are the standard 2-letter codes (ISO 3166-1 alpha-2) that identify each country online — the same ones used in country domains (.es, .fr...) and address forms. Write them in uppercase, separated by commas if you add more than one. No need to memorize them: just the country you or your team usually connect from.

Your country not in the table? Search "ISO 3166-1 alpha-2 code" followed by your country's name, or check the full official list at iso.org.

Email Notification

Enabling the "Email the administrator" checkbox means you'll receive an email at your WordPress contact address (Settings → General) every time a suspicious country change is detected on an active session. The email includes the affected user, the original country, the country the change was detected from, and whether the session was closed or only logged, so you can act if you consider it necessary even in Monitor mode.

Available on the PRO plan. Configurable from Login & 2FA → Anti-Hijack in the SeenSecure panel.

👤 Restricted Accounts

The restricted accounts system blocks common or dangerous usernames that attackers often use. When an IP attempts to access with multiple restricted names, it is automatically blocked and added to the permanent blacklist.

Blocked Usernames by Default

You can add or remove names from the list. Changes apply immediately.

IP Block Threshold

Configure how many attempts with restricted names from the same IP trigger a permanent blacklist block with reason login_blackname.

Recent Attempts Summary

The panel shows a summary table with the latest access attempts using restricted usernames, including the IP, attempted name, date/time, and whether it resulted in a block.

IPs Blacklisted via login_blackname

List of IP addresses that have been permanently blocked for exceeding the restricted name attempt threshold. You can unblock them manually from the Active Blocks section.

🛡️ Active Blocks

The Active Blocks section shows all currently active temporary and permanent blocks. It allows managing users and IPs that have been blocked for suspicious activity, offering options to manually unblock.

Blocks Table

The table includes the following columns:

• User/IP: Blocked username or IP address.

• Type: Permanent or Temporary, indicated with a color badge.

• Reason: Reason for the block (failed login, login_blackname, etc.).

• Attempts: Number of failed attempts recorded before the block.

• Blocked Since: Block start date and time.

• Expires: Expiration date (for temporary blocks).

Unblock

Each table row includes an "Unblock" button with confirmation. When clicked, it asks for confirmation before removing the block. This prevents accidental unblocks.

📊 Event History

The Event History logs all login security-related activities: successful and failed logins, temporary and permanent blocks, manual unblocks, and password changes. Provides filters and pagination for easy navigation.

Event Types

Available Filters

• Event Type: Dropdown to select a single event type (or "All").

• Username: Text field to filter by specific user.

• IP Address: Text field to search events from a specific IP.

Pagination & Display

• Rows per page: Selector with options 10, 20, 50, 100, 200.

• Client-side pagination: Page navigation is handled in the browser without reloading.

• Country flags: Flags are displayed from ISO country codes to identify the origin of events.

🔧 Troubleshooting

A legitimate user or IP got blocked

Go to Login Security → Active Lockouts: you'll see the full table with the reason, number of attempts, and whether the block is temporary or permanent. Temporary blocks expire on their own; permanent ones each have their own "Unblock" button (with a confirmation step, to prevent accidental unblocks). No need to wait or touch the general configuration to free up a single person.

My team keeps getting locked out while testing login

Check the Event History first: filter by your IP to confirm how many real failed attempts you're generating. If the block comes from a restricted username (reason login_blackname), you're probably testing with a generic test username (admin, test, etc.) — always use a real username for testing. If it's from normal failed attempts, raise the Lockout Threshold or add your IP to the Firewall whitelist so it doesn't count against the limit.

Frequently Asked Questions

Do temporary blocks need me to do anything? No, they expire automatically. Only permanent ones (typically from a restricted username) need manual unblocking from Active Lockouts.

What's the difference between a lockout from failed attempts and one from a restricted username? The first counts normal failed login attempts; the second specifically triggers when someone tries usernames already blocked by default (like "admin"), and its per-IP attempt threshold is configured separately.

Can I see where login attempts are coming from? Yes, the Event History and the detected-attempts summary show the IP, date/time, and country flag for each attempt's origin.

Can Anti Session Hijacking close the session of someone traveling or using a VPN? If the mode is set to "Block", yes — that's its expected behavior: it closes that specific session as soon as it detects a country change, which is exactly what happens when traveling or switching VPNs. It's not a ban: they just need to log in again normally. If you'd rather just get the alert without closing the session, use "Monitor" mode instead.