MFA Engine & Secure Storage

Description: Provides the underlying Multi‑Factor Authentication engine and stores MFA secrets securely for enrolled users. How it works: AegisShield’s MFA engine manages enrollment state, secret material, and verification, and integrates with the WordPress login flow. How to access / configure: WP Admin → AegisShield → Login Guard (or MFA section within Login Guard). Open the MFA panel. Enroll your account and confirm MFA is working before enforcing for others. Recommended setting: Enroll administrators first and verify recovery methods before enforcing site-wide.

Block Unknown Usernames

Description: Blocks or penalizes login attempts for usernames that do not exist, reducing user enumeration and brute-force noise. How it works: If block_unknown_user is enabled, AegisShield can treat unknown usernames as hostile and deny/lock faster. How to access / configure: WP Admin → AegisShield → Login Guard. Enable “Block unknown user” (if shown) and Save Changes. Recommended setting: Enable on most sites; keep it off only if you rely on custom auth flows that probe usernames.

Description: Uses a hidden field to catch automated login bots and block them early. How it works: Bots that fill fields humans never see are flagged; the request can be denied/logged. How to access / configure: WP Admin → AegisShield → Login Guard. Enable “Honeypot” (if available) and Save Changes. Recommended setting: Enable honeypot on most sites; it’s low-friction and blocks many bot attacks.

Lockout Duration (Minutes)

Description: Sets how long an IP/user stays locked out after exceeding max attempts. How it works: When the threshold is hit, Login Guard stores a lockout with an expiry based on lockout_minutes. How to access / configure: WP Admin → AegisShield → Login Guard. Find “Lockout Minutes”. Set the duration and Save Changes. Recommended setting: 15–30 minutes is a good baseline; increase if attacks persist.

Description: Sets how many failed login attempts are allowed before a lockout triggers. How it works: Login Guard increments a counter on failed authentication and locks out when the counter reaches max_attempts. How to access / configure: WP Admin → AegisShield → Login Guard. Find “Max Attempts”. Set the value and Save Changes. Recommended setting: Use 3–5 for most sites; use 3 if the site is frequently attacked.

Description: Records failed login attempts to help identify attacks and targeted accounts. How it works: Each failed login writes an event with timestamp, username (if provided), and IP address to support investigations. How to access / configure: WP Admin → AegisShield → Login Guard. Review the recent failed login activity section/chart. Cross-check with Activity Log for related events. Recommended setting: Watch for repeated attempts on admin accounts; consider enforcing MFA for administrators (Pro).

Basic Brute-Force Protection

Description: Limits repeated login attempts to reduce password-guessing attacks. How it works: AegisShield counts failed attempts per IP/user and triggers lockouts when thresholds are exceeded. How to access / configure: WP Admin → AegisShield → Login Guard. Ensure Login Guard is enabled. Configure Max Attempts and Lockout Duration (if available) and Save Changes. Recommended setting: Start with 5 max attempts and 15 minutes lockout; tighten for high-risk sites.

Description: Chooses the export format used when archiving logs. How it works: AegisShield serializes log entries into the chosen file format to support external storage/analysis. How to access / configure: WP Admin → AegisShield → Activity Log. Enable archiving. Choose a format (CSV or JSON) and Save Changes. Recommended setting: Use JSON if you plan to ingest into SIEM/analytics; CSV for quick manual review.

Log Archive Frequency

Description: Sets how often logs are rotated/archived when archiving is enabled. How it works: AegisShield schedules archive jobs at the selected cadence to keep log storage predictable. How to access / configure: WP Admin → AegisShield → Activity Log. Enable archiving. Select a frequency (e.g., weekly/monthly) and Save Changes. Recommended setting: Weekly archiving is a good default for active sites; monthly for low-traffic sites.

Description: Turns on archiving of older logs instead of immediate deletion (Pro-oriented workflow). How it works: When enabled, AegisShield rotates logs by the configured frequency and stores them in the selected format before purging. How to access / configure: WP Admin → AegisShield → Activity Log. Enable “Archive logs” (if shown). Choose Archive Frequency and Format, then Save Changes. Recommended setting: Enable archiving if you need long-term audit trails beyond database retention.

Archives: FAQs | Aegisify - WordPress Tools, Security…

Categories: AegisShield
MFA Engine & Secure Storage
read more
Categories: AegisShield
Block Unknown Usernames
read more
Categories: AegisShield
Honeypot Login Trap
read more
Categories: AegisShield
Lockout Duration (Minutes)
read more
Categories: AegisShield
Max Login Attempts
read more
Categories: AegisShield
Failed Login Logging
read more
Categories: AegisShield
Basic Brute-Force Protection
read more
Categories: AegisShield
Log Archive Format
read more
Categories: AegisShield
Log Archive Frequency
read more
Categories: AegisShield
Log Archive Enabled
read more

What’s New At Aegisify