AlphaLogin

AlphaLogin replaces the plain WordPress login with everything a modern sign-in needs — and every feature is real, not a settings mock-up.

Sign in without a password

• Passkeys (WebAuthn) — face, fingerprint or a security key; usernameless sign-in with browser autofill, several keys per user, registration from the profile screen
• Magic links — "Email me a sign-in link": single-use, hashed, expiring, rate-limited, never reveals whether an address exists
• Single sign-on — one Alpha accounts portal signs the user into every connected site; accounts created on first sign-in with a role picked by an email-domain map; the portal's social providers (Google, Apple, Microsoft, GitHub, Facebook, X, Discord, LinkedIn, Twitch, Slack) come with it; optional popup sign-in; portal profile pictures
• Portal sign-in only mode for sites that should not accept passwords at all

A second step when you want one

• Authenticator app (TOTP) with QR setup, ten recovery codes, "required for these roles"
• XML-RPC refused while two-factor is on; a file-based kill switch (wp-content/alphalogin-off) if you ever lock yourself out

Keep attackers out

• Brute-force guard — attempts counted per IP and per username, lockouts that escalate for repeat offenders, an allow-list for your own address, generic error messages, XML-RPC off, lockout emails
• Session manager — see every device a user is signed in on, sign one or all out; admins can do it for anyone and reset lost second factors
• Audit log — every sign-in, failure, lockout, factor change and session revoke with IP, device and country (when your edge provides it); filter, search, CSV export, retention

Make it yours

• Login page designer — logo, background colour or image, accent, card colour, corner radius, centered or split layout, light/dark scheme, title, subtitle, footer, custom CSS — with a live preview of the real wp-login.php before you save
• [alphalogin_button] shortcode for a front-end sign-in button