Cerber Security Features

• Limit login attempts when logging in by IP address or subnet Class C
• Monitors logins made by login forms, XML-RPC, REST API requests or auth cookies
• Restricts access with rich GEO country rules
• Restrict access with White IP Access list and Black IP Access List by IP address, IP range or subnet
• Detects bots and hacker activity by using a set of traps
• Malware scanner & WordPress integrity checker
• Automatic cleanup of malware and suspicious files
• Manage multiple WP Cerber instances from one dashboard.
• Traffic Inspector screens all suspicious requests and blocks them if they can harm a website.
• Log all activities related to the logging in and logging out process
• Protects WordPress accounts with Two-Factor Authentication (2FA)
• Antispam: reCAPTCHA for WordPress and WooCommerce forms
• Hide wp-login.php from possible attacks and return 404 HTTP Error
• Hide wp-admin (dashboard) and return 404 HTTP Error when a user isn’t logged in
• Make Custom login URL for logging in (rename wp-login.php)
• Limits the number of registrations from one IP address
• Block WordPress user accounts
• Block user registration with a set of prohibited usernames or by specifiying REGEX patterns for such usernames.
• Role-based access control for WordPress REST API
• Protects registration form with reCAPTCHA and Cerber antispam and bot detection engine
• Immediately block IP or subnet when attempting to log in with non-existent username
• Disable automatic redirecting to the login page
• Disable WordPress REST API
• Disable XML-RPC: block access to the XML-RPC server including Pingbacks and Trackbacks
• Disable feeds (block access to the RSS, Atom and RDF feeds)
• Restrict access to the XML-RPC, REST API feeds by White Access list by IP address, IP range or subnet
• Stop user enumeration via author pages
• Stop user enumeration via REST API
• Protection against (DoS) attack CVE-2018-6389
• Proactively block IP subnet class C for a suspicious IP address
• Citadel mode for massive brute force attack
• Play nice with fail2ban: write failed attempts to the syslog or custom log file
• View and filter out activity list by IP, username or particular event
• Extra WHOIS information for IP: country, abuse contacts, network owner and much more
• Handles site/server behind reverse proxy
• Configurable email notifications with rate limiting

Screenshots

More screenshots

P.S. Initially the plugin was created as a better alternative to WordPress Limit Login Attempts plugin.