Everything you need to set up and use SecurePress.
Last updated August 16, 2026
On this page
Install SecurePress like any WordPress plugin: Plugins → Add New, search for SecurePress, then Install and Activate. You'll find its settings under SecurePress in your wp-admin sidebar.
Every feature is off by default except basic rate limiting — turn on only what you need from the tabs on the left of the settings screen.
Moves your login page from the well-known /wp-login.php to a URL only you know — this alone stops the overwhelming majority of automated bot login attempts, since they only ever try the default path.
Set your custom slug on the Login URL tab. Once saved, bookmark the new URL immediately — the old /wp-login.php will stop working for normal login (a documented emergency-recovery method, described in the tab itself, always stays available in case you get locked out).
Locks out an IP address after too many failed login attempts (5 attempts, 15-minute lockout, by default) — configure both numbers on the Rate Limiting tab.
Pro adds an IP allowlist and blocklist, one entry per line, supporting both single IPs and CIDR ranges (e.g. 203.0.113.0/24) — permanently trust your office network, or block a known-bad range outright. This applies across every login method on your site: password, Magic Link, and Email Two-Factor all check it, not just the password form.
Free, available to every install regardless of license. Adds a bot challenge to the login form, using your choice of Cloudflare Turnstile, Google reCAPTCHA, or hCaptcha — pick one on the CAPTCHA tab and enter that provider's site key and secret key (each provider issues its own pair from its own dashboard).
Covers the regular password login, a Magic Link request, and an Email Two-Factor code request — anywhere the login form can be submitted. If the provider's own verification service is briefly unreachable, login is still allowed through rather than risking a site-wide lockout over a third-party outage.
By default, WordPress sends mail through your server's own mail function — many hosts deliver this unreliably or block it outright, often with no visible error, so emails can simply never arrive. The SMTP tab lets you configure a real SMTP provider (Gmail SMTP, SendGrid, Mailgun, or similar) for reliable delivery — this fixes mail for your entire site, not just SecurePress's own emails.
Fill in your provider's host, port, encryption type, username, and password, turn on Use custom SMTP, then use the Send Test Email button to confirm delivery actually works before relying on it.
A genuinely passwordless option — type your email, get sent a link, click it, you're in. It sits alongside the regular password form by default (both are offered); Pro's Passwordless-only mode can hide the password field entirely and require Magic Link instead.
Every magic-link email includes a safeguard against corporate email security scanners (like Outlook's Safe Links) that automatically open links before you do — clicking the link auto-completes login in a real browser, but an automated scanner fetching the same link can't trigger it, so your link can't get silently used up before you actually click it.
Link expiry time is configurable on the Passwordless tab; IP-binding on the link (Pro) ties it to the network that requested it, so a leaked link can't be used elsewhere.
Not passwordless — this is a required second step, not an alternative to your password. Username and password are checked completely normally first; only once that succeeds does SecurePress email a 6-digit code and hold login at a code-entry screen until it's verified. Password proves something you know; the emailed code proves you also have access to the account's inbox.
Turn it on from the Passwordless tab — it applies to every account on the site the moment it's enabled, with no separate per-user setup step.
Pro feature. Country and VPN/hosting-IP signals are unreliable on their own — plenty of legitimate users log in through a VPN or while traveling. By design, a match only triggers an emailed confirmation code, never an outright block, unless you explicitly switch a rule to Block mode.
Applies uniformly across password login, Magic Link, and Email Two-Factor — not just the password form. Uses a free IP-lookup provider by default (rate-limited, non-commercial license); if the lookup itself is ever unreachable, login is allowed through rather than blocked on a broken third-party API.
Pro feature. A Slack or Discord incoming-webhook URL, alerted independently of email — since email delivery itself may be the exact thing that's broken. Fires once when delivery degrades, and once when it recovers. Paste your webhook URL on the Passwordless tab and send a test alert to confirm it's working.
Bounce tracking is also available for hosts/providers that support delivery-failure webhooks — this catches mail that was accepted but later bounced, which a send-time-only check can't see on its own.
Records login-relevant activity on your site. Free shows the most recent 50 entries, view-only. Pro extends this to full history with CSV export, for sites that need to keep or review a longer record.
Enter your license key on the License tab to unlock Pro features and enable one-click updates directly from your WordPress Plugins page — no manual zip uploads. A license is valid on one site at a time; if you need to move it to a different site, deactivate it from the old site first (or contact support if you no longer have access to the old site).
Manage your license, view your site's activation, and see your billing history any time from your customer dashboard.
Pro adds Magic Link login to your store or membership site's own login form — WooCommerce, MemberPress, and Paid Memberships Pro are all supported. Enable the one you use from the Passwordless tab; each only activates if that plugin is actually installed. Geo/IP protection (if enabled) still applies fully during this flow.
Pro also lets you replace the default SecurePress branding on every login-related email — Magic Link, OTP, and confirmation codes — with your own logo and colors, from the Email Branding settings.
Pro feature. Read-only visibility across your network from Network Admin — which sites have SecurePress active, and their current risk-relevant settings at a glance. This doesn't centrally push or enforce settings onto subsites; each site's own admin still controls its own configuration.
Locked out after enabling Custom Login URL? Use the emergency-recovery method documented directly on that settings tab — it stays available specifically for this situation.
Can't turn on Magic Link or Email Two-Factor? Both require SMTP to be actively configured first — see the SMTP Setup section above. The setting page will show you exactly what to do before either toggle becomes available.
Magic link / OTP emails not arriving? Check the SMTP tab — it shows your site's current email delivery status and lets you send a test email at any time. If delivery is genuinely broken, password login stays available automatically rather than locking anyone out.
License won't activate? A license only works on one site at a time — if you're moving it from an old site, deactivate it there first, or reach out via a support ticket if you no longer have access to that site.
For anything not covered here, sign in to your customer dashboard and open a support ticket — you can optionally link it to a specific license so we immediately have the right context.
Open a Support Ticket