Title: DCI Admin Security
Author: DreamCode Infotech
Published: <strong>October 1, 2026</strong>
Last modified: October 13, 2026

---

Search plugins

![](https://ps.w.org/dci-admin-security/assets/banner-772x250.png?rev=3723214)

![](https://ps.w.org/dci-admin-security/assets/icon-128x128.png?rev=3723214)

# DCI Admin Security

 By [DreamCode Infotech](https://profiles.wordpress.org/dreamcodeinfotech/)

[Download](https://downloads.wordpress.org/plugin/dci-admin-security.1.0.0.zip)

 * [Details](https://wol.wordpress.org/plugins/dci-admin-security/#description)
 * [Reviews](https://wol.wordpress.org/plugins/dci-admin-security/#reviews)
 *  [Installation](https://wol.wordpress.org/plugins/dci-admin-security/#installation)
 * [Development](https://wol.wordpress.org/plugins/dci-admin-security/#developers)

 [Support](https://wordpress.org/support/plugin/dci-admin-security/)

## Description

Protect WordPress login and wp-admin with IP allowlisting, custom login URLs, email
OTP, rate limiting, CAPTCHA, logging and alerts.

### Features

 * Allow exact IPv4/IPv6 addresses and CIDR ranges.
 * Accept IPv4 shorthand such as `171.61`, stored as `171.61.0.0/16`.
 * Change the WordPress login URL.
 * Protect the normal `wp-login.php` endpoint.
 * Optional IP blocking for the login and `wp-admin` pages, while keeping `admin-
   ajax.php` available.
 * Return a 404 response for logged-out visitors who request the default `wp-admin`
   URL.
 * Optional Cloudflare `CF-Connecting-IP` detection.
 * Optional trusted `X-Forwarded-For` detection for known reverse-proxy setups.
 * Optional localhost/loopback bypass for local development.
 * Brute-force rate limiting and temporary lockouts.
 * Email OTP verification for administrators, delivered to each administrator’s 
   WordPress profile email address.
 * Administrator-configured emergency fallback code for environments where email
   cannot be delivered.
 * Optional Google reCAPTCHA v2, reCAPTCHA v3 or hCaptcha on the WordPress login
   form.
 * Security event logging with an administrator viewer and configurable retention.
 * Optional email and Slack alerts for repeated blocked-IP or brute-force events.

### Important

IP blocking is optional. When it is disabled, the custom login URL remains active
but the allowlist is not enforced. Keep at least one known administrator IP in the
allowlist before enabling IP blocking.

Only enable Cloudflare IP detection when the site is actually behind Cloudflare.
Only enable trusted `X-Forwarded-For` when the server is behind a trusted reverse
proxy that sets that header.

On localhost, PHP commonly sees `127.0.0.1` or `::1` rather than the browser’s public
VPN address. Use a publicly reachable staging site for an end-to-end VPN IP test.

The emergency fallback code is stored as a password hash and is never displayed 
after saving.

### External Services

This plugin can optionally communicate with third-party CAPTCHA verification services
when CAPTCHA is enabled:

 * Google reCAPTCHA: the login page loads Google reCAPTCHA assets and sends the 
   submitted CAPTCHA token to Google’s verification endpoint. See https://policies.
   google.com/privacy and https://policies.google.com/terms.
 * hCaptcha: the login page loads hCaptcha assets and sends the submitted CAPTCHA
   token to hCaptcha’s verification endpoint. See https://www.hcaptcha.com/privacy
   and https://www.hcaptcha.com/terms.

The plugin does not contact these services when CAPTCHA is disabled.

### IP access examples

Exact IP: `186.189.26.220`

IPv4 /16 shorthand: `171.61`

CIDR: `171.61.0.0/16`

### Email OTP

After a successful WordPress administrator password check, a six-digit OTP is generated
and sent to that administrator’s WordPress profile email address.

If email delivery is unavailable, an administrator-configured emergency fallback
code can be used.

## Screenshots

[[

[[

[[

## Installation

 1. Upload the plugin ZIP from Plugins > Add New > Upload Plugin.
 2. Activate DCI Admin Security.
 3. Open Settings > DCI Admin Security.
 4. Choose whether to enable IP blocking. If enabled, add at least one IP address or
    CIDR range that should be allowed to reach the protected login/admin area.
 5. Set the custom login slug. The new URL is applied automatically after saving.
 6. Save the General settings and open the new custom login URL to test it.
 7. If you enabled IP blocking, verify access from an allowed IP before relying on 
    it in production.
 8. Configure Email OTP, CAPTCHA, rate limiting and alerts as required.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“DCI Admin Security” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ DreamCode Infotech ](https://profiles.wordpress.org/dreamcodeinfotech/)

[Translate “DCI Admin Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/dci-admin-security)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/dci-admin-security/),
check out the [SVN repository](https://plugins.svn.wordpress.org/dci-admin-security/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/dci-admin-security/)
by [RSS](https://plugins.trac.wordpress.org/log/dci-admin-security/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.0.0

 * Resolved Plugin Check database-query and nonce warnings.
 * Sanitized emergency fallback-code input.
 * Added explicit versions to CAPTCHA provider scripts.
 * Kept IP allowlist, email OTP, and WordPress.org compatibility fixes from 1.0.0.

#### 1.0.0

 * Removed the obsolete TOTP/two-factor authentication implementation and related
   files.
 * Fixed WordPress coding-standard issues in IP handling, AJAX actions, CAPTCHA 
   output and custom database queries.
 * Added proper login CAPTCHA script enqueueing and a CAPTCHA nonce.
 * Improved PHP 7.4 compatibility by removing PHP 8-only string helper usage.
 * Updated documentation and feature list for the email OTP implementation.

#### 2.4.10

 * Improved IP allowlist matching and localhost development controls.
 * Added IP diagnostics and test tools.

#### 2.4.6

 * Added explicit trusted proxy handling for `X-Forwarded-For`.
 * Normalized IPv4-mapped IPv6 client addresses.

#### 2.0.0

 * Added brute-force rate limiting, CAPTCHA, security logging and alerts.
 * Added administrator email OTP verification.

#### 1.0.0

 * Initial release with IP allowlist and custom login URL protection.

## Meta

 *  Version **1.0.0**
 *  Last updated **2 days ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.0 or higher **
 *  Tested up to **7.1.3**
 *  PHP version ** 7.4 or higher **
 *  Language
 * [English (US)](https://wordpress.org/plugins/dci-admin-security/)
 * Tags
 * [admin security](https://wol.wordpress.org/plugins/tags/admin-security/)[custom login](https://wol.wordpress.org/plugins/tags/custom-login/)
   [ip whitelist](https://wol.wordpress.org/plugins/tags/ip-whitelist/)[login security](https://wol.wordpress.org/plugins/tags/login-security/)
   [security](https://wol.wordpress.org/plugins/tags/security/)
 *  [Advanced View](https://wol.wordpress.org/plugins/dci-admin-security/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/dci-admin-security/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/dci-admin-security/reviews/)

## Contributors

 *   [ DreamCode Infotech ](https://profiles.wordpress.org/dreamcodeinfotech/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/dci-admin-security/)

## Donate

Would you like to support the advancement of this plugin?

 [ Donate to this plugin ](https://ko-fi.com/dreamcodeinfotech)