Logliy – Login Protect (Passkey, Email, SSO)

FAQ

How do email access rules work?

On Email, under General email settings, enable the allowlist and enter one rule per line: @example.org, staff-*@example.net or person@example.org. Rules are case-insensitive. A domain rule does not include subdomains; wildcards are allowed only before @. An enabled empty list denies all email login. Rules apply to the account email even when the user enters a username. Both sending and redemption check the current rules. Passkeys and SSO have separate policies. Public request responses do not reveal whether an account is eligible.

Are login codes and links single-use?

Yes. Email challenges are stored in a dedicated database table and consumed atomically. A new request replaces the previous challenge of the same method. Codes allow at most five attempts without extending their original expiry. Changes to the account email invalidate outstanding challenges. Upgrading to 0.2.0 invalidates pending codes/links from older versions; request a new one.

How can I restrict SSO?

On SSO, configure a separate email allowlist and/or permitted values from a signed ID-token claim such as groups, roles or realm_access.roles. At least one group must match exactly. When both restrictions are enabled, both must pass, including for existing linked accounts. Rules run before account linking or creation and never assign WordPress roles. Verified email is required by default in 0.2.0. Your provider must return boolean email_verified: true; an administrator can disable this requirement for a trusted provider that does not support the claim.

What does the security log store?

Event type, UTC time, actor/account IDs and plugin file names only. No raw IP addresses, email addresses, codes, links, user agents or tokens are recorded. IDs can still identify users; include the log in your privacy assessment. The log is enabled by default, capped at 10000 events, and retained for 30 days (configurable 1–365). Expired entries are hidden immediately; hourly WordPress cron deletes them. Administrators can inspect it on Security log. It is a local operational log, not a tamper-proof audit service.

Which security emails are available?

All categories are off by default. Enable account security, plugin changes, user changes and/or Logliy settings changes on Security. Plugin installations, updates (including automatic updates), activations, deactivations and deletions each have their own notification switch. Existing all-plugin notification choices are preserved. User notifications cover creation, deletion and role changes. Account security notices cover Passkeys, SSO links, session revocation and email/password changes. Administration notices go to the configured recipient or the WordPress administration email; account notices also go to the affected account. At most 20 messages per recipient per hour are sent; failures and suppressed messages are logged. WordPress may send its own notices independently. Delivery uses wp_mail and depends on your site’s mail setup.

Can I revoke individual sessions?

Profiles show active sessions with individual and all-session revoke buttons. Users can manage their own sessions; administrators need permission to edit the target user. With custom session storage, only all-session revocation is supported here. Revoking the current session signs you out.

How do I enable SSO?

Open Settings → Logliy → SSO. Enable SSO and enter your OpenID Provider Issuer URL, Client ID, and Client Secret. Register the shown Redirect URI at the provider. The SSO tab appears on the login form only when those three fields are set. ID tokens must be signed with RS256. New WordPress users are not created unless you turn on Create users.

I locked myself out

Add to wp-config.php:

define( 'LOGLIY_ALLOW_PASSWORD', true );

Then sign in with your password and adjust Logliy settings.

Does this replace Wordfence?

No. Logliy is the login method layer. Wordfence remains your WAF / lockout / scanner layer.

Application Passwords / WP-CLI / XML-RPC

Application Passwords and WP-CLI are not blocked by the password policy.
With password login off, XML-RPC authentication with the account password is blocked by default (affects the WordPress mobile app, Jetpack, and some backup tools). Enable Allow XML-RPC passwords under Logliy → General if a tool still requires it. Prefer Application Passwords when the client supports them.