Login Security for WooCommerce Pro — Location Verification, Trusted Devices, WhatsApp Codes & IP Blocking

### Passwords leak. This stops what happens next.

Credential stuffing does not break into your store — it walks in through the
front door with a password that leaked somewhere else entirely. **Login Security
for WooCommerce Pro** puts a second door in the way.

When a customer signs in from a city the store has never seen them use, the
login is held and a **6-digit code** goes out by email or WhatsApp. No code, no
session. If the password is sitting in a breach dump, the attacker still gets
nothing.

When the location is familiar, nothing happens at all — no code, no extra click,
no friction for the customer who just wants to check out.

---

### Verification that does not annoy people

**Location-based, not login-based.** Every successful login is recorded with its
IP and approximate city. The next login is compared against it. Same city,
straight through. New city, verify.

**Trusted devices.** A customer can tick "Remember this device" after entering a
code and will not be asked again on that browser for as long as you allow — 1 to
365 days, your choice. This is the setting that turns a security plugin from
something customers tolerate into something they never notice.

**Codes by email or WhatsApp.** Email works out of the box with two templates:
one for a first-ever login, one that shows the new location beside the previous
one so a customer can tell at a glance whether it was really them. Turn on
WhatsApp delivery and the code arrives on the customer's phone instead, sent to
the number already on their WooCommerce billing address.

---

### Blocking that holds up

**Automatic IP blocking.** Five wrong codes and the code itself is destroyed
*and* the IP is blocked for a duration you choose, one minute to seven days. The
attempt counter follows the code, not just the IP, so rotating through a proxy
pool does not reset it.

**Country rules.** Allow only the countries you trade with, or block the ones
you never do. Two-letter codes, one field.

**IP allow and deny lists.** Always-allow an office or VPN range so staff skip
verification entirely. Always-block ranges that only ever bring trouble. Single
addresses or CIDR, IPv4 and IPv6.

**Behind Cloudflare or another proxy? Handled properly.** The visitor IP is read
from `CF-Connecting-IP` only after confirming the request really came from a
Cloudflare IP range, so the header cannot be spoofed to fake a location or dodge
a block.

**Blocked IP history.** Every block logged with time, expiry and user agent.
Unblock one address or clear the lot.

---

### A login popup that fits your theme

A Sign In / Sign Up / Forgot Password modal that opens from any link or button
carrying a CSS class you choose. No shortcode, no theme edit, no page-builder
widget to configure.

**Cloudflare Turnstile, applied with judgement.** Always on for Sign Up and
Forgot Password, where bots actually cause damage. On Sign In it stays out of the
way and only appears after three failed attempts — real customers are not made to
prove they are human on every visit.

---

### Made to look like your store

Background image, site logo and illustration are set from the Media Library, plus
a custom CSS box for the verification page. The verification email can be
replaced from your theme.

Six geolocation providers — IPWhois, IPAPI, IP-API, GeoPlugin, Cloudflare,
IPInfo — with automatic failover, so one provider going down does not stop a
login. Answers are cached for twelve hours per address to stay well inside the
free tiers.