Bottom line: WP Login Lockdown is the paid version of a long-running WordPress plugin, now built by WebFactory Ltd in Zagreb, Croatia. It protects the login page: it locks out IPs after failed attempts, adds captchas, sends an email confirmation as a second factor, blocks countries, hides the login URL and runs a rule-based firewall. On AppSumo it sells three plans, 5 websites for $59, 50 websites for $118 or unlimited websites for $177, all once. The detail most buyers miss sits on the plan cards: Plans 1 and 2 show a cross next to the centralized dashboard, white-labeling and rebranding. Only Plan 3 ticks them. The listing is “Covered by our We Got Your Back guarantee” and refundable up to 60 days.
Best for: site owners and agencies who want a focused login guard on many WordPress sites for a one-time price.
Think twice if: you want authenticator-app 2FA, captchas on WooCommerce checkout, or a plugin you can resell to clients as its own product.
We have no affiliate deal with WebFactory Ltd or AppSumo; links go to the official pages. How we review.
Updated 29 October 2026. This WP Login Lockdown review rests on what we read that day: the WP Login Lockdown listing on AppSumo, including all three plans, the deal terms, the founder FAQ, questions and reviews, and the free plugin’s Login Lockdown & Protection page on WordPress.org with its feature list and changelog. We haven’t installed it on a site, so we describe the plans, the features and what buyers report, not how many attacks it stops.
WP Login Lockdown review at a glance
| What we checked | What the pages say |
|---|---|
| AppSumo plans | 5 sites $59, 50 sites $118, unlimited $177, once |
| Listed “was” prices | $99, $299, $499 |
| Dashboard, white-labeling, rebranding | Crossed on Plans 1 and 2, ticked on Plan 3 |
| 2FA | A confirmation link sent by email, not an authenticator app |
| Captcha | Login page only, per the team in November 2025 |
| Free version | 100,000+ active installations on WordPress.org |
| AppSumo guarantee | “Covered by our We Got Your Back guarantee” |
| Refund | Refundable up to 60 days |
| Listing rating | 4.76 stars from 37 reviews, 2,982 bought |
What WP Login Lockdown does
The plugin started life in 2007 as Login Lockdown, a free tool on WordPress.org. Its changelog says WebFactory took over development in September 2022 and released a new codebase with a PRO version in April 2023. The free plugin now lists 100,000+ active installations, was tested up to WordPress 7.1.4, and was last updated on 6 October 2026.
Its core idea is simple. It records the IP and time of every failed login, and when one IP fails too often, it locks that IP out of the login or out of the whole site. The WordPress.org page gives the default: a 1-hour lockout after 3 failed attempts within 5 minutes, all of which you can change. Around that core, the paid version adds:
- Captchas: the WordPress.org page lists five, a built-in one, two from Google, Cloudflare Turnstile and hCaptcha. The built-in captcha is described as GDPR compatible.
- Two-factor authentication: a unique link sent to your email that must be clicked before the login completes.
- Country blocking: block chosen countries from the whole site or only from logging in, with a custom message.
- Cloud protection: shared IP blacklists and whitelists, managed in one place and applied to every site you connect.
- Temporary access links: time-limited logins for someone else, with a cap on how often each link can be used.
- A firewall: the founder’s May 2023 update describes it as “based on the popular G7 firewall,” with “several hundred rules spread into 11 modules.”
- Login page design with a dozen preset looks, and hiding or changing the login URL.
Each AppSumo plan card ticks “All current and future plugin features,” the firewall, login page design, “Cloudfare integration,” cloud blacklists and “Hide/change login form URL.” The founder FAQ adds that everything runs in the admin, so “nothing is loaded, added, or processed on the front-end,” and that disabling the plugin undoes its changes.
The line most people miss: what Plans 1 and 2 cross out
Here’s where the plan cards need a slow read. Three lines appear on every card, and on two of them they carry a cross, not a tick:
| Line on the plan card | Plan 1 (5 sites) | Plan 2 (50 sites) | Plan 3 (unlimited) |
|---|---|---|---|
| Centralized dashboard for controlling sites, licenses & IP access lists | Cross | Cross | Tick |
| White-labeling | Cross | Cross | Tick |
| Rebranding (no code editing needed) | Cross | Cross | Tick |
| All current and future plugin features | Tick | Tick | Tick |
| Cloud blacklists | Tick | Tick | Tick |
That matters most to the buyers the listing courts. It names “IT/security agencies” and “Web design agencies” under “Best for,” and its own copy promises a centralized dashboard to “control all your purchases, licenses, sites, and Cloud Blacklists.” Turns out a 50-site agency on Plan 2 gets the sites but not the rebranding. Most people miss this because the overview higher up the page never mentions tiers at all; the crosses only appear once you open the plan cards.
There’s also a puzzle we couldn’t settle. Cloud blacklists are ticked on every plan, yet WordPress.org says those lists are managed “in your Login Lockdown Dashboard,” and the founder FAQ says every buyer gets Dashboard access to download the plugin and manage licences. So Plans 1 and 2 seem to reach the Dashboard in some form, while the full “controlling sites, licenses & IP access lists” line is crossed. Honestly, the cards don’t say where the line falls. Ask support which Dashboard functions a 1-code or 2-code account sees before day 60.
| Plan | Price |
|---|---|
| Plan 1 Your own sites |
$59 once |
| Plan 2 Freelancers with many sites |
$118 once |
| Plan 3 Agencies, white-label |
$177 once |
One-time prices on AppSumo, read 29 October 2026; each plan is a number of stacked codes (1 to 3), with listed 'was' prices of $99, $299 and $499. WebFactory's own pricing page at wploginlockdown.com showed a bot check, so its direct prices were not read. A free version is on WordPress.org.
Prices checked Oct 29, 2026 on WP Login Lockdown’s own pricing page. Lifetime deals are listings that can end or change, so check the live listing before you buy.
Picking a plan: four worked examples
One business site. Plan 1 at $59 covers 5 sites, about $11.80 a site, and you’ll use one slot plus maybe a staging copy. You don’t need white-labeling to protect your own login, so the crosses don’t cost you anything.
A freelancer with a dozen client sites. Five slots run out fast. Plan 2 at $118 covers 50 sites, about $2.36 each across a full roster. If you’ve got clients who log in to their own admin area, though, expect them to see the WP Login Lockdown name, because rebranding is crossed on this plan.
An agency that sells care plans. Plan 3 at $177 is the only tier with white-labeling and the full dashboard line, and the extra $59 over Plan 2 buys unlimited sites as well. In practice, if the plugin will sit inside a branded maintenance package, Plan 3 is the one to buy.
An agency planning to resell the plugin itself. Read the next section before spending anything.
The licence moves between sites: the founder FAQ says that once you deactivate it on one site, “the license goes back into your license pool.” So a 5-site plan is five live sites at a time, not five sites for life. When you hand a client site over to someone else, don’t forget to deactivate the plugin there first, so the slot returns to your pool.
The resale question
The longest critical review on the listing is about licensing, not security. In February 2026 a verified buyer rated it 1 star after spending “most of an entire weekend” on branding, then learning three limits: “You can’t sell it directly to clients,” “You can’t include purchase or download links,” and, even fully white-labeled, “it can only be bundled into a broader service, not offered as its own solution.” They also called support “very slow.”
In September 2026 another agency buyer answered that view in a 5-star review. They argued that an agency white-label licence lets you install a rebranded plugin across client sites as part of a service, and that no lifetime licence lets you resell individual keys. Both reviewers agree on the facts. They disagree on whether the listing makes them clear enough.
The deal terms we read don’t mention resale at all. When you’re planning to bill clients for the plugin as a line item, get the licence wording from WebFactory in writing first.
What buyers report
The listing shows 4.76 stars from 37 reviews: 34 five-star, 1 four-star and 2 one-star ratings, with 2,982 bought.
Agencies like the shared blacklist. An August 2025 reviewer uses it on their own and client sites, notes that it works through .htaccess, and values one IP blacklist that applies across all their websites. A September 2026 agency reviewer says the dashboard makes managing many client installs easy and that the 2FA works well. Honestly, that shared list is the reason to choose this over a single-site login plugin if you’ve got more than a handful of sites to look after.
Some moved from other tools. A March 2025 reviewer had used Wordfence for years and switched because it blocked visitors from random countries; they liked limiting country blocks to the login page.
Feature requests recur. In June 2025 a buyer asked for 2FA through an authenticator app and a user audit log. In March 2024 another wanted an email for every successful login, since only failures are logged. A December 2023 reviewer wanted to change settings across many sites from the dashboard, because today it’s site by site, and said their request on the public roadmap was deleted without comment.
One serious failure report. In May 2024 a buyer gave 1 star after a fatal PHP error took their company sites down during install, and said the chat support “takes hours.” That review is old, and the WordPress.org changelog shows security and bug-fix releases since, most recently on 2 and 6 October 2026. Still, don’t forget to install on staging first.
The free version’s reviewers are cooler. WordPress.org shows 4.3 stars from 61 reviews. A February 2024 reviewer there gave 3 stars and called the free plugin “total adware,” saying the admin is now covered in PRO prompts. That’s about the free build, not what AppSumo buyers install.
Questions and answers on the listing
The team answers questions quickly, usually within a day, though not always fully.
- WooCommerce (November 2025). A buyer asked about 2FA for customer accounts and captchas on WooCommerce forms. The team replied: “Captcha can be used only on the login page,” and pointed to its separate WP Captcha plugin.
- WP Reset (December 2025). Asked whether WP Reset includes Login Lockdown, the team said the plugins “are entirely different” and only share the dashboard design.
- Hiding plugins (January 2026). The founder’s answer: “Sorry, no. That’s not possible.”
- Two login URLs (February 2026). A buyer asked about one login URL for admins and one for customers. The reply sent them to email support, so the listing has no public answer.
- MalCare and Patchstack (July 2026). “Yes, you should be able to run them together.”
The terms
The deal terms read:
- “Lifetime access to WP Login Lockdown.”
- “All future WP Login Lockdown updates.”
- “You must redeem your code(s) within 60 days of purchase.”
- “Stack up to 3 codes.”
- “GDPR compliant.”
- “Previous AppSumo customers who purchased WP Login Lockdown can buy more codes to increase their feature limits.”
The guarantee line reads “Covered by our We Got Your Back guarantee,” with “Carefully selected by AppSumo for quality, performance, and support.” The listing says “Refundable up to 60 days.” The “was” prices of $99, $299 and $499 are the listing’s own figures. We couldn’t read the vendor’s pricing page to check them, so treat them as AppSumo’s reference, not a saving we’ve confirmed. Like every AppSumo deal, this one can end.
WP Login Lockdown vs Wordfence
The listing names Wordfence as the tool it replaces, “for a one-time price from $59 instead of a subscription.” We didn’t price Wordfence or read its feature pages for this review, so we can’t compare them line by line. What we can say from the pages we read: WP Login Lockdown is focused on the login, lockouts, a firewall and IP lists, and the team itself says it’s “not a magic solution for all your security issues.” Two reviewers asked for a malware scanner, which the founder said in April 2025 was on its to-do list. If you need malware scanning, skip the idea that this replaces a full security suite; one buyer’s question about running it alongside MalCare and Patchstack got a yes.
Common mistakes with the WP Login Lockdown deal
Buying Plan 2 for white-labeling. It’s crossed on Plans 1 and 2. Only Plan 3 ticks it.
Expecting authenticator-app 2FA. The 2FA is an email confirmation link. Reviewers on WordPress.org and AppSumo have asked for app codes since 2023.
Planning captchas for checkout. The team says captcha works on the login page only.
Reselling the plugin as its own product. A February 2026 reviewer learned it can only be bundled into a broader service.
Skipping a staging install. One buyer’s sites went down on install in 2024. Test on a copy.
Missing the 60-day redemption window. Redeem every code straight away, including any you stack later.
Who WP Login Lockdown suits
A small business with one or two WordPress sites. Plan 1 locks down the login, adds email 2FA and blocks countries.
A freelancer with many client sites. Plan 2’s 50 sites, if the plugin can show its own name.
An agency selling branded care plans. Plan 3, the only tier with white-labeling and the full dashboard line.
Anyone who wants app-based 2FA or a full malware suite. Skip it, or pair it with another tool.
How to test it inside the refund window
- Install it on a staging copy of your busiest site and check the site still loads.
- Lock yourself out on purpose with wrong passwords, then release the IP from the panel.
- Turn on email 2FA and a captcha and log in from a phone and a laptop.
- Add an IP to a cloud blacklist and see whether it reaches a second site on your plan.
- Ask support in writing which Dashboard functions your plan has, and what the licence allows for client sites.
What we couldn’t check
WebFactory’s own pricing page at wploginlockdown.com showed a bot check and refused our connection, so we couldn’t read its direct prices, plan names or refund policy. That means we can’t say whether the AppSumo deal is cheaper than buying direct, or confirm the listing’s “was” prices. We didn’t install the plugin, trigger lockouts or test the firewall. We also couldn’t confirm which Dashboard features Plans 1 and 2 keep, given the crossed line and the ticked cloud blacklists. Settle that before day 60.
FAQ: WP Login Lockdown questions
Is WP Login Lockdown a one-time payment on AppSumo?
Yes. On 29 October 2026 the plans were $59 for 5 websites, $118 for 50 and $177 for unlimited, each once.
Which WP Login Lockdown plan includes white-labeling?
Only Plan 3 (3 codes, $177). Plans 1 and 2 show a cross next to white-labeling, rebranding and the centralized dashboard.
Does WP Login Lockdown 2FA work with Google Authenticator?
Not on the pages we read. The 2FA sends a link to your email that you click to finish logging in.
Is WP Login Lockdown free?
A free version, Login Lockdown & Protection, is on WordPress.org. Country blocking, 2FA, the Google captchas, hCaptcha, cloud protection and temporary access are marked as PRO features there.
The verdict
WP Login Lockdown is a focused, well-rated login guard with a long history and recent updates, and this listing carries AppSumo’s We Got Your Back cover plus a 60-day refund. Read the plan cards closely, though: the dashboard, white-labeling and rebranding lines are crossed on Plans 1 and 2, so agencies should treat Plan 3 as the real agency tier. Email-only 2FA, login-only captchas and the resale limits keep the score below the top of our list. In practice, a site owner can buy Plan 1 with few worries, while an agency should skip the middle tier unless it truly doesn’t need its own branding.
WP Login Lockdown on our desks
Our YouTube channels cover WP Login Lockdown from different angles. Each video opens on YouTube.
Guides on Business Software
- What Is Stacking on AppSumo? Codes, Tiers and LimitsStacking means buying more than one code for the same AppSumo deal to reach a bigger plan. It only works on code deals the partner allows, and only while the deal is live.
- Is AppSumo Plus Worth It? The $99 Break-Even, Worked OutAppSumo Plus costs $99 a year and takes 10% off every order, plus $100 in coupons on the annual plan. Here's the break-even sum with real deal prices, and who should skip it.
- What Happens If an AppSumo Product Shuts Down?When an AppSumo tool closes, the lifetime deal ends with it. Whether you get anything back depends on the listing's We Got Your Back line, your Plus status, the purchase date and a 30-day claim deadline.