The login popup that guards your WordPress site.
Sign-in and registration in a popup on any page, with a security system behind it: two-factor login, country blocking, IP bans, backdoor and fake-admin protection, an emergency lockdown button and a log of everything it stopped.
Free with every 4 Page Website. Or $380 once, or $10 a month for 38 months.
| 09:14 | 203.0.113.7 | CN | admin | Country blocked |
| 09:12 | 198.51.100.22 | RU | root | IP banned |
| 09:03 | 192.0.2.10 | CA | jsmith | Logged in |
| 08:47 | 192.0.2.88 | CA | mlee | 2FA code used |
| 08:31 | 203.0.113.50 | BR | administrator | Username refused |
| 08:22 | 198.51.100.9 | VN | (none) | Admin account blocked |
| 08:20 | 192.0.2.10 | CA | jsmith | Registered |
Six layers between an attacker and your dashboard.
Each layer works on its own. Together they stop a bad login, a stolen password and a planted plugin.
Front door
Popup login with reCAPTCHA and strong password rules.
Identity
Two-factor codes, recovery codes and trusted devices.
Perimeter
Country blocking, IP bans and attempt limits.
Integrity
Blocks backdoor plugins and hidden admin accounts.
Automation
Protection that switches on and off by the clock.
Visibility
Logs, live stats and email reports of what was stopped.
See every feature before you switch it on.
These are drawn from the plugin’s real screens and pages. Example names and addresses are used throughout.
Popup login and registration
Open sign-in from a menu item, any link or a shortcode, without sending visitors to wp-login.php.
- Login, register and lost password in one tabbed box.
- Custom registration fields you add, remove and drag into order.
- Password strength meter and leaked-password check.
- Open it from any link. Add
#rzlp-loginor?rzlp=registerto a page address. - A different destination per link with
data-rzlp-redirect. - Hide Register on an embed with
register="no".
Ten designs. Pick one and it applies everywhere.
The popup, the embedded form, the compact login and your users’ account pages all share the design you choose. Override a single page with theme="cocoa".
Classic
White box, WordPress-blue button.
Midnight
Dark navy, sky-blue button.
Soft
Rounded, pale violet, pill button.
Minimal
Square, black and white.
Bold
Thick outlines, yellow button.
Cocoa
Cream and coffee brown.
Sage
Calm herb green.
Peach
Sunny peach, terracotta button.
Blush
Gentle rose, berry button.
Fireside
Dark cabin brown, amber button.
Google Authenticator, Authy or any TOTP app.
Two-factor login
A stolen password is not enough. People set it up themselves from their profile or a page on your site.
- Authenticator apps with a QR code, plus 8 recovery codes.
- Require it your way for single accounts or whole roles.
- Built into the popup. The code step appears in the same box.
- Secrets stored encrypted and every code works once.
[razenet_2fa]
Account pages your users manage themselves
Trusted devices and two-factor settings on a page of your site, in any of the ten designs, at the width you choose.
- Trusted devices. Remember a browser, revoke it any time. A password change revokes all.
- Width slider for the account pages, or
width="640"per page. - Your own “no access” wording for logged-out visitors, with links.
[razenet_trusted_devices]
Revoke
Revoke
Lockout length15 min
Banned IPs14
Username blocklistadmin, root, test
Blank-header POST blockOn
Block attackers before the password is checked
Rules run first, so a banned address or blocked country never gets as far as a password guess.
- Country blocking by country code, with a safety check so you can’t lock yourself out.
- IP bans and a whitelist, including automatic bans for repeat offenders.
- Username blocklist that refuses “admin” before it is tried.
- Attempt limits and lockouts after too many failures.
- Hides which usernames exist. One generic message for every failed login.
A log that shows who was stopped
Logins, blocks and bans in one place, with the country, username and reason for each.
- Filter by type and date range.
- Ban in bulk. Tick rows and ban their IPs together.
- Top countries, IPs and usernames at a glance.
- Log retention clears old entries on its own.
uploads/2026/10/cache.phpPHP file in the uploads folderDelete
plugins/media-helper/loader.phpRuns hidden code from an encoded stringDeactivate
User "support_admin"Administrator added outside WordPressDemote
Stops backdoor plugins and hidden admins
Attackers often skip the login and plant a plugin or a second administrator. This catches both.
- Admin-account guard. Only a signed-in administrator can create admin power. Anything else is blocked and you are emailed.
- Backdoor request blocker for known trigger parameters.
- Plugin blocklist, approved-only mode and install lock.
- Early guard stops blocked plugins before they load.
- Scanner for plugins, themes, uploads and suspicious accounts, with one-click fixes.
One button puts the site in lockdown
When something looks wrong, shut the doors first and investigate second.
- Maintenance mode for visitors with a proper 503 page.
- Email to the administrator the moment it starts.
- Other sessions ended, and sign-in limited to administrators or chosen IPs.
- Plugin installs, file editing, new users, REST API and XML-RPC paused.
- Lift it in one click, or from wp-config.php if needed.
We’ll be right back
This site is briefly offline for maintenance.
Protection that follows your maintenance hours
Keep “Approved plugins only” and “Lock plugin installs” on all week, and open a short window only when you update.
- Days and times in your site’s timezone, including windows that run past midnight.
- Add as many windows as you need. If two disagree, protection wins.
- Open a window now for 15 minutes to 4 hours, then it closes by itself.
- Pauses during a lockdown so nothing reopens by accident.
Live stats on your own pages
Show what your login protection is doing, right on your site. Private by default.
- Four shortcodes: dashboard, logs, activity and top lists.
- Five designs: Clean Card, Ledger, Terminal, Tiles and Minimal.
- Masked for everyone but admins. Log messages are never shown.
[razenet_dashboard] [razenet_logs] [razenet_activity] [razenet_top]
A report in your inbox
Weekly, biweekly or monthly, or sent on demand. Add your own logo.
- Five report templates with a live preview and an editor.
- Top countries, IPs and usernames in every report.
- Week and month breakdowns of logins, failures and blocks.
Close doors people leave open
Log people out when they walk away, and see who is signed in right now.
- Idle auto-logout with a “Stay logged in” warning.
- Force logout ends a session on every device.
- Exclude roles from auto-logout and hide the toolbar for chosen roles.
2h 14mForce logout
41mForce logout
8mForce logout
Fits small spaces, and says hello
A one-row login for sidebars and headers, and a choice of twelve looks for the message a signed-in person sees.
- Compact login stacks on phones and works with 2FA, reCAPTCHA and all ten designs.
- Twelve “already logged in” designs with a width control and left, centered or right position.
[razenet_login_compact] · [razenet_login notice=”sage” notice_width=”500″]
Everything in the plugin.
Every feature is included in the one price. Nothing is locked behind a higher tier.
Popup and forms
- Menu, link or shortcode triggers and URL triggers.
- Custom registration fields with widths and drag-to-order.
- Banner image from your Media Library.
- Auto-login after signup and custom redirects, per link too.
- Google reCAPTCHA v2, invisible or v3.
- Google sign-in verified on your server, administrators excluded by default.
Login security
- Two-factor with recovery codes and per-role enforcement.
- Trusted devices that skip reCAPTCHA or country checks.
- Leaked-password check that never sends the full password.
- Strong password rules you set.
- Application passwords switch to turn them off sitewide.
- Hides usernames from author pages and the REST API.
Site protection
- Admin-account guard and backdoor request blocker.
- Plugin blocklist, approved-only and install lock.
- Early guard must-use file.
- Daily scanner with one-click fixes.
- Emergency lockdown with admin bar shortcut.
- Protection schedule with maintenance windows.
Visibility
- Login log with country, status and session length.
- Blocked activity in the same log, with bulk ban.
- Email reports in five templates.
- Four live-stats shortcodes in five designs.
- Currently logged in with force logout.
- Five admin tabs instead of thirteen.
No forever subscriptions. Pay once, your choice.
Both options cost the same. Either way the plugin is yours to keep.
Pay once
- Every feature included
- No renewals, ever
Spread it out
- Every feature included
- Payments stop after month 38
- No extra cost for paying monthly
Same total either way. Many security plugins charge again every year for as long as you use them. Here you pay $380 in total and that is the end of it.
Buy it, keep it
One payment plan, no seats, no paywalled features and no nag screens. If it helps you, please share Razenet with someone who needs it. Referrals help fund the next plugin.
What your site needs
- WordPress
- 5.6 or newer
- PHP
- 7.2 or newer
- reCAPTCHA
- Optional, free Google keys
- Google sign-in
- Optional, free Google client ID
- Email reports
- Your site’s normal email setup
See it on a real site before you decide.
We’ll walk you through the popup, the log, two-factor setup and the site protection on a live demo and answer your questions.
