Role-Based MFA Enforcement

Description: Enforces MFA for selected WordPress roles (Pro). How it works: On login, AegisShield checks the user’s role against the enforced list and requires MFA if applicable. How to access / configure: WP Admin → AegisShield → Login Guard → MFA (Pro). Enable enforcement and select roles. Save changes and notify users. Recommended setting: Enforce at least for administrators and editors; expand to authors on content-heavy sites.

Description: Allows MFA codes to be delivered via email as a second factor. How it works: When enabled, AegisShield generates a one-time code and sends it to the user’s email, then validates it during login. How to access / configure: WP Admin → AegisShield → Login Guard → MFA. Enable Email MFA (if shown). Test mail delivery to ensure codes arrive reliably. Recommended setting: Use email MFA only if SMTP deliverability is strong; prefer authenticator-based MFA for highest security.

Offline QR Enrollment & Backup Codes

Description: Supports QR enrollment and provides one-time backup codes for account recovery. How it works: Backup codes are generated securely and can be used if the authenticator device is unavailable. How to access / configure: WP Admin → AegisShield → Login Guard → MFA. Enroll via QR. Download/record backup codes during enrollment. Recommended setting: Always generate backup codes and store them securely off-site.

Description: A guided interface to enroll users into MFA (QR, email, or backup codes depending on configuration). How it works: The UI walks users through generating/confirming a second factor and stores the enrollment state upon successful verification. How to access / configure: WP Admin → AegisShield → Login Guard → MFA. Click “Enroll” for your account. Follow the prompts to complete setup and save backup codes. Recommended setting: Require admins to enroll; store backup codes in a password manager.

MFA Engine & Secure Storage

Description: Provides the underlying Multi‑Factor Authentication engine and stores MFA secrets securely for enrolled users. How it works: AegisShield’s MFA engine manages enrollment state, secret material, and verification, and integrates with the WordPress login flow. How to access / configure: WP Admin → AegisShield → Login Guard (or MFA section within Login Guard). Open the MFA panel. Enroll your account and confirm MFA is working before enforcing for others. Recommended setting: Enroll administrators first and verify recovery methods before enforcing site-wide.

Block Unknown Usernames

Description: Blocks or penalizes login attempts for usernames that do not exist, reducing user enumeration and brute-force noise. How it works: If block_unknown_user is enabled, AegisShield can treat unknown usernames as hostile and deny/lock faster. How to access / configure: WP Admin → AegisShield → Login Guard. Enable “Block unknown user” (if shown) and Save Changes. Recommended setting: Enable on most sites; keep it off only if you rely on custom auth flows that probe usernames.

Description: Uses a hidden field to catch automated login bots and block them early. How it works: Bots that fill fields humans never see are flagged; the request can be denied/logged. How to access / configure: WP Admin → AegisShield → Login Guard. Enable “Honeypot” (if available) and Save Changes. Recommended setting: Enable honeypot on most sites; it’s low-friction and blocks many bot attacks.

Lockout Duration (Minutes)

Description: Sets how long an IP/user stays locked out after exceeding max attempts. How it works: When the threshold is hit, Login Guard stores a lockout with an expiry based on lockout_minutes. How to access / configure: WP Admin → AegisShield → Login Guard. Find “Lockout Minutes”. Set the duration and Save Changes. Recommended setting: 15–30 minutes is a good baseline; increase if attacks persist.

Description: Sets how many failed login attempts are allowed before a lockout triggers. How it works: Login Guard increments a counter on failed authentication and locks out when the counter reaches max_attempts. How to access / configure: WP Admin → AegisShield → Login Guard. Find “Max Attempts”. Set the value and Save Changes. Recommended setting: Use 3–5 for most sites; use 3 if the site is frequently attacked.

Description: Records failed login attempts to help identify attacks and targeted accounts. How it works: Each failed login writes an event with timestamp, username (if provided), and IP address to support investigations. How to access / configure: WP Admin → AegisShield → Login Guard. Review the recent failed login activity section/chart. Cross-check with Activity Log for related events. Recommended setting: Watch for repeated attempts on admin accounts; consider enforcing MFA for administrators (Pro).

News & Events

Categories: AegisShield
Role-Based MFA Enforcement
read more
Categories: AegisShield
Email-Based MFA
read more
Categories: AegisShield
Offline QR Enrollment & Backup Codes
read more
Categories: AegisShield
MFA Enrollment UI
read more
Categories: AegisShield
MFA Engine & Secure Storage
read more
Categories: AegisShield
Block Unknown Usernames
read more
Categories: AegisShield
Honeypot Login Trap
read more
Categories: AegisShield
Lockout Duration (Minutes)
read more
Categories: AegisShield
Max Login Attempts
read more
Categories: AegisShield
Failed Login Logging
read more

keep updated & don’t miss anything!

We regularly develop new plugins and release them for free because they’re solutions we trust and use ourselves.

By entering your email, you agreed to our Privacy Policy and Terms & Conditions

Frequently Asked Questions

Support Docs

Ticketing System

mfa roles pro login aegisshield description enforces selected wordpress works checks user role against enforced list requires applicable access configure admin guard enable enforcement select save changes notify users recommended setting enforce least administrators editors expand authors content heavy sites

Powered by Aegisify Links

2026 - Aegisify.com - Everything Your WordPress Site Needs, One Platform. One Price.

Privacy Policy * Terms of Use * Free Plugin Disclaimer * End User License Agreement