=== TINXDK Login Limit Lite ===
Contributors: tinxdk
Tags: login, security, brute force, limit login attempts, altcha
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 8.2.35
Stable tag: 2.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Limit failed login attempts per IP address and block the IP for a number of hours. Includes self-hosted ALTCHA spam protection.

== Description ==

One simple rule: after X failed logins from an IP address, login from that IP is blocked for Y hours.

* Counts failed logins on wp-login.php: X attempts, then the IP is blocked for Y hours. Shows the remaining attempts and resets the counter after a configurable window.
* Existing lockouts are enforced everywhere (wp-login.php, XML-RPC, REST application passwords, WooCommerce): a locked IP is refused even when the password is correct, and the password check is not even run.
* Admin page under Settings > Login Limit with the active lockouts and one-click unlock.
* ALTCHA (self-hosted proof of work, no third party, no cookies) on the wp-login.php login, lost password, reset password and registration forms and on the WooCommerce account forms (login, registration, lost password).
* Emergency access: add `define( 'TINXDK_LL_DISABLE', true );` to wp-config.php to switch enforcement and ALTCHA off.
* Developer friendly: the filter `tinxdk_ll_client_ip` overrides the resolved IP, `tinxdk_ll_altcha_required` decides when ALTCHA is required.

The plugin does not contact any external service.

**TINXDK Login Limit Pro** is a separate plugin that extends this one: counting failures via XML-RPC, REST application passwords and WooCommerce logins, allowlist and blocklist, trusted proxy headers, a lockout log with GDPR options, e-mail alerts and WP-CLI commands. Read more at https://tinxdkcloud.dk/wordpress-plugins/tinxdk-login-limit/#pro

== Installation ==

1. Install the plugin from the WordPress plugin directory, or upload the folder to `/wp-content/plugins/`, and activate it.
2. Configure it under Settings > Login Limit.

== Frequently Asked Questions ==

= Does it work behind a reverse proxy or Cloudflare? =

The free plugin uses the connecting address (REMOTE_ADDR). Use the filter `tinxdk_ll_client_ip` to supply the real client IP, or the Pro plugin, which honours proxy headers only from trusted proxies.

= I locked myself out. What now? =

Add `define( 'TINXDK_LL_DISABLE', true );` to wp-config.php, log in, unlock the IP address under Settings > Login Limit > Active lockouts and remove the line again.

= Does ALTCHA send data to a third party? =

No. The proof-of-work challenge is created and verified on your own server.

= Does it work together with TINXDK Captcha Lite? =

Yes. When TINXDK Captcha Lite is active, it takes care of ALTCHA on all forms and this plugin shows no widget of its own, so your visitors never see two widgets. Login Limit keeps counting failed logins.

= What happens to my settings if I install or remove the Pro plugin? =

Settings and data are stored in the same options and tables. The free plugin keeps working, and keeps the data written by Pro, when Pro is deactivated.

== Changelog ==

= 2.0.1 =
* Changed: Renamed to TINXDK Login Limit Lite (no functional change). Slug, settings and data are unchanged.

= 2.0.0 =
* Changed: The plugin is now split in two. TINXDK Login Limit Lite (this plugin, WordPress.org) contains everything that works for everyone: counting failures on wp-login.php, enforcing lockouts on every entry point, the active lockouts list with unlock and ALTCHA on all public forms. All code for licensed features (XML-RPC, REST application password and WooCommerce counting, allowlist/blocklist, trusted proxies, log and statistics, e-mail alerts, WP-CLI) and the licence client and updater have moved to the separate plugin TINXDK Login Limit Pro.
* Changed: Renamed from "TINXDK WP - Login Limit" (tinxdk-wp-login-limit). Settings, database tables and options are unchanged, so existing data is kept. Install TINXDK Login Limit Pro if you used the licensed features.
* New: Extension points for the Pro plugin (actions and filters prefixed `tinxdk_ll_`).
* New: A dismissible note about the Pro plugin on the plugin's own settings page and a "Pro" link in the plugin list.

= 1.1.1 =
* Changed: ALTCHA on the WooCommerce account forms is part of the free edition.

= 1.1.0 =
* New: Free and licensed edition.

= 1.0.0 =
* First release.

== Upgrade Notice ==

= 2.0.1 =
Renamed to TINXDK Login Limit Lite (no functional change).

= 2.0.0 =
The licensed features have moved to the separate plugin TINXDK Login Limit Pro. Install it from tinxdkcloud.dk to keep XML-RPC/REST/WooCommerce counting, lists, log, e-mail alerts and WP-CLI. Settings and data are kept.
