All-In-One Security (AIOS) Setup: Login Lockout, Login URL, Firewall

This article is a localized edition of the Japanese original. Read the Japanese original

All-In-One Security (AIOS) is a free WordPress security plugin that lets you configure login protection, a firewall, file change detection and more in one place. It was previously called "All In One WP Security & Firewall" and is now developed by TeamUpdraft, the team behind UpdraftPlus. There is also a paid version (Premium), but every feature in this article is available in the free version.

The screen names in this article were checked in November 2026 on AIOS 5.5.1. AIOS has no Japanese translation, so its screens appear in English even when WordPress itself is set to Japanese. This article uses the on-screen English labels.

Installation and screen layout

In the admin screen, go to "Plugins" → "Add Plugin", search for "All-In-One Security", install it and activate it. With WP-CLI:

wp plugin install all-in-one-wp-security-and-firewall --activate

After activation, an "AIOS" item is added to the left admin menu. The main menus are as follows.

Do not turn everything on at once. Enable features one at a time and check that the site and login still work after each one. Login-related features in particular can lock you out of the admin screen if misconfigured.

User Security: admin username and user enumeration

Configure these on the "User accounts" tab of "AIOS" → "User Security".

• Admin user security: if a user named admin exists, you can rename it with "Change username". Brute-force attacks often target admin.
• Display name security: lists accounts whose login name and display name are the same. The display name is shown publicly as the author name, so make it different from the login name (change it under "Display name publicly as" in each user's "Profile").
• User enumeration settings: enabling "Disable user enumeration" prevents usernames from being discovered through URLs such as /?author=1 (that URL returns a 403 error).

User Security: login lockout

On the "Login lockout" tab of the same "User Security" menu, you can lock out IP addresses that fail to log in repeatedly for a set time. It is disabled by default.

Other main settings you can configure here:

• Display generic error message: shows one generic error on failed logins instead of distinguishing "wrong username" from "wrong password".
• Instantly lockout invalid usernames: immediately locks out IP addresses that try to log in with usernames that do not exist.
• Notify by email: sends an email when a lockout happens.
• Login lockout IP whitelist settings: excludes the listed IP addresses from lockout. Adding your office's fixed IP address reduces the risk of locking yourself out.

You can view and release locked IP addresses on the "Locked IP addresses" tab of "AIOS" → "Dashboard".

Brute Force: rename the login page

On the "Rename login page" tab of "AIOS" → "Brute Force", you can choose a login URL to use instead of wp-login.php.

1. Turn on "Enable rename login page feature".
2. Enter a hard-to-guess string in "Login page URL" (for example my-login).
3. After saving, the new login URL is shown on screen (https://example.com/my-login if your permalink setting is "Post name" or similar).

Once enabled, visitors who are not logged in get a 404 when they open wp-login.php, and /wp-admin/ no longer leads to the login screen. Bookmark the new URL or otherwise keep a record of it.

Brute Force: CAPTCHA, IP allow list and honeypot

• CAPTCHA settings: under "Default CAPTCHA", choose Cloudflare Turnstile, Google reCAPTCHA V2 or Simple math CAPTCHA (a simple addition) and show it on the login, registration, password reset and comment forms, among others. For Turnstile and reCAPTCHA, enter the site key and secret key you obtained from each service.
• Login whitelist: enabling "Enable IP whitelisting" blocks access to the login page from any IP address not on the list. Use it if you have a fixed IP address.
• Honeypot: enabling "Enable honeypot on login page" adds a field to the login form that humans cannot see, and rejects logins from bots (automated programs) that fill it in.

Firewall: blocking XML-RPC and other PHP rules

The "PHP rules" tab of "AIOS" → "Firewall" includes XML-RPC controls, disabling TRACE, refusing comments posted through proxies, and restricting REST API use by visitors who are not logged in.

• Completely block access to XMLRPC: blocks all access to xmlrpc.php. Features that use XML-RPC, such as Jetpack and the WordPress mobile app, stop working.
• Disable pingback functionality from XMLRPC: keeps XML-RPC but turns off only the pingback feature. Choose this if you rely on services that use XML-RPC.

The AIOS PHP firewall can be set to load before WordPress core. If a notice with a "Set up now" button appears at the top of the screen, clicking it configures the firewall to load first using PHP's auto_prepend_file.

Firewall: .htaccess rules

The ".htaccess rules" tab of "Firewall" configures features that write rules into .htaccess. They only take effect on Apache (and the compatible LiteSpeed). Nginx servers do not read .htaccess, so you need to apply the same restrictions in the server configuration.

• Enable basic firewall protection: denies direct access to .htaccess and wp-config.php, hides the server signature, and sets an upper limit on upload file size.
• Block access to debug.log file: prevents wp-content/debug.log from being read from outside.
• Disable index views: stops directory contents from being listed.

Back up your current .htaccess before the rules are written. When you deactivate AIOS, the rules it wrote are removed.

File Security and Scanner: disable file editing and detect changes

• "File protection" tab of File Security: "Disable PHP file editing" turns off editing theme and plugin PHP files from the admin screen. "Delete default WP files" on the same tab deletes default files such as readme.html that hint at your version.
• "File change detection" tab of Scanner: turn on "Enable automated file change detection scan" and set the interval (hours, days or weeks) in "Scan time interval" to check regularly whether files have been added, removed or changed since the last scan. "Send an email when a file change is detected" emails you when changes are found. Exclude frequently changing files such as logs and caches with "Files/Directories to ignore".

How to get back in if you are locked out

If you are locked out by login lockout

If you can reach the admin screen from another IP address (such as a smartphone connection), release the lock under "Locked IP addresses" in "Dashboard". If you cannot, use one of the following.

Adding the following line to wp-config.php, before the /* That's all, stop editing! */ line, stops login lockout from working. Once you have logged in and released the lock, delete this line.

define( 'AIOS_DISABLE_LOGIN_LOCKOUT', true );

If you can use WP-CLI, you can also view and delete the lockout records. Replace the wp_ in the table name with your site's prefix, as shown by wp db prefix.

# Show lockout records
wp db query "SELECT id, failed_login_ip, lockdown_date, release_date FROM wp_aiowps_login_lockdown ORDER BY id DESC LIMIT 10"

# Delete the records for your IP address (replace 203.0.113.10 with your IP address)
wp db query "DELETE FROM wp_aiowps_login_lockdown WHERE failed_login_ip = '203.0.113.10'"

If you forgot the login URL

You can check the configured login page name with WP-CLI.

wp option pluck aio_wp_security_configs aiowps_login_page_slug

If you cannot use WP-CLI or SSH, temporarily rename the wp-content/plugins/all-in-one-wp-security-and-firewall folder over FTP or similar. AIOS stops, and you can log in from wp-login.php. After logging in, rename the folder back and activate the plugin again.

Related articles

• Protecting WordPress from brute-force attacks
• Protect WordPress by disabling XML-RPC
• Limit login attempts without a plugin

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)