--- title: "Ulkoovi – Login Security for Ultimate Member" date: 2026-08-24 modified: 2026-08-24 author: "userelements_wh8sr3" url: "https://www.userelements.com/ulkoovi-login-security-ultimate-member/" markdown_url: "https://www.userelements.com/ulkoovi-login-security-ultimate-member.md" type: page excerpt: "Ulkoovi – Login Security for Ultimate Member Spam registrations, brute-force logins, two-factor & password policy Close the two doors into […]" --- # Ulkoovi – Login Security for Ultimate Member Spam registrations, brute-force logins, two-factor & password policy Close the two doors into your membership site — registration and login — with Turnstile, 2FA, lockouts, ban lists and password rules. Most protections stay off until you turn them on. Last updated: 24 August 2026 · Version **1.0.2** Version **1.0.2** · Requires **UM 2.12+** · Tested with **WordPress 7.0** · **GDPR** export & erase · **Off by default** Ultimate Member → Settings → Extensions → Login & Registration Security #### Detected IP for this request: `203.0.113.42` - Login limits - Turnstile - Two-factor - Stop Forum Spam - Akismet - Ban lists - Sessions - Password policy - XML-RPC - Login protection - Stop Forum Spam - Akismet - Turnstile - Ban lists - Two-factor - Sessions - Passwords - IP & allowlists - XML-RPC - Stop spam signups with Stop Forum Spam, Akismet, and Cloudflare Turnstile - Lock out brute-force attacks on Ultimate Member, wp-login.php, WooCommerce and XML-RPC - Authenticator-app 2FA with hashed recovery codes — QR drawn in the browser - Password expiry, reuse history, first-sign-in force change, and session caps - Security Log with one-click unlock; WP-CLI escape hatch if you lock yourself out --- **Ulkoovi** (Finnish for *outer door*) hardens the two doors into an Ultimate Member site: registration and login. Ultimate Member stores the current profile and handles forms; it does not, on its own, rate-limit failed passwords across wp-login.php, challenge bots on register, or give members an authenticator app. Ulkoovi adds those controls in one settings screen inside Ultimate Member. Third-party spam checks stay opt-in so nothing leaves your site until you say so. This plugin is an independent User Elements extension — not affiliated with Ultimate Member. ## What’s in version 1.0.2 Lockout and 2FA attempt counters increment atomically, so parallel requests cannot skip counts during a brute-force burst. Plugin URI now points at the public site homepage. ## Stop spam before it becomes a member Layer checks on Ultimate Member registration forms. Each service is off until you enable it, and each one is disclosed under **Settings → Privacy** when it is on. - **Stop Forum Spam** — optional checks on email, IP and username, with a confidence threshold, age filter, and fail-open when the API is unreachable. - **Akismet** — a second layer when the Akismet plugin is installed with a valid API key. - **Cloudflare Turnstile** — free bot challenge on Ultimate Member register, login and password-reset forms, plus wp-login.php. Theme, size and appearance controls included. - **Ban lists** — extends Ultimate Member’s blocked IP, email and word lists with CIDR and wildcard IP matching, and can enforce those bans at login as well as registration. ## Lockouts that cover the whole site Failed-login limits run on WordPress’s `authenticate` filter. Ultimate Member forms, wp-login.php, WooCommerce and XML-RPC all count toward the same window. Configure max attempts, attempt window, short lockout, and an extended lockout after repeated lockouts. Allowlisted IPs and usernames skip lockouts and selected spam checks. Ultimate Member → Security Log #### Security Log · Release all lockouts EventUserIPWhenLockout appliedadmin198.51.100.142 min agoFailed loginadmin198.51.100.142 min agoRegistration blockedpromo\_bot203.0.113.8811 min agoTwo-factor passedmaria192.0.2.411 hr ago ## Two-factor without a third-party QR service Members enrol an authenticator app from their Ultimate Member account. Recovery codes are hashed and shown once. The challenge is rate-limited after a correct password, on both Ultimate Member login and wp-login.php. Admins can view status and remove 2FA from the user profile. The QR code is drawn locally in the browser. Account → Two-Factor Authentication #### Scan this QR code with your authenticator app Store these recovery codes somewhere safe. Each code can be used once. They will not be shown again. 7K2M-9QPD 4NXT-1WHC B8RL-6VYA 0FJM-3ZKE ## Password, session and network policy - **First sign-in** — force a password change after registration. - **Expiry & reuse** — expire passwords after a set number of days; block reuse of recent passwords. - **Sessions** — cap concurrent signed-in sessions per user (optionally exclude administrators). - **Proxy-safe IPs** — trust forwarded headers only when the request arrived from an address on your Trusted proxies list (Cloudflare `CF-Connecting-IP`, X-Forwarded-For, X-Real-IP, or `REMOTE_ADDR`). - **XML-RPC** — leave alone, strip password-requiring methods, or disable entirely. Keep “leave alone” if you use Jetpack or the WordPress mobile apps. **Locked out?** Open **Ultimate Member → Security Log** and press **Release all lockouts**. If you cannot reach wp-admin, run `wp ueas-security unlock`. ## Included at a glance Features included in Ulkoovi Login SecurityCapabilityIncludedStop Forum Spam on registration✓Akismet registration check✓Cloudflare Turnstile on UM forms & wp-login.php✓Site-wide failed-login limits & escalating lockouts✓UM ban lists with CIDR / wildcards & login enforcement✓TOTP 2FA with hashed recovery codes✓Password expiry, history & first-sign-in force change✓Concurrent session caps✓Trusted-proxy IP detection✓XML-RPC hardening modes✓Security Log + WP-CLI unlock / prune✓WordPress privacy export & erase✓ ## Works with - **Ultimate Member** — settings live under Extensions; ban lists stay in Access. Requires 2.12.0 or newer. - **WordPress authentication** — lockouts apply anywhere passwords are checked, including WooCommerce login. - **WordPress Privacy Tools** — personal-data exporter and eraser for Security Log rows, plus suggested privacy-policy text. ## Requirements - Ultimate Member 2.12.0+ - WordPress 6.5+ (tested with 7.0) - PHP 7.4+ ## Common questions ### Does Ulkoovi require Ultimate Member? Yes. It is an extension for Ultimate Member 2.12.0 or newer and will not load without it. ### Does the login limit protect wp-login.php and WooCommerce? Yes. Enforcement runs on WordPress’s `authenticate` filter, which covers Ultimate Member forms, wp-login.php, WooCommerce, XML-RPC, and other password entry points. ### I locked myself out. How do I get back in? If you can still reach wp-admin, open **Ultimate Member → Security Log** and press **Release all lockouts**. If you cannot, run `wp ueas-security unlock` over WP-CLI or SSH. ### Does Ulkoovi send visitor data to third parties? Only if you turn a service on. Stop Forum Spam, Akismet and Cloudflare Turnstile are **off by default**. Enabling any of them sends data to that service — review your privacy policy first. Suggested wording is added automatically under **Settings → Privacy**. ### Does Cloudflare Turnstile cover WooCommerce login? No. Turnstile is available on selected Ultimate Member forms and on wp-login.php. Login attempt limits and ban lists still apply to WooCommerce through WordPress authentication. ### Where do I edit ban lists? Under **Ultimate Member → Settings → Access → Other**. Ulkoovi extends those lists with CIDR and wildcard IP matching and optional login enforcement. It does not keep a second copy. Lists from older versions of this plugin are merged into the Ultimate Member lists on upgrade. ### Does Ulkoovi store passwords? No. Ulkoovi does not log passwords. Two-factor secrets stay on the site; recovery codes are hashed; the enrolment QR code is drawn in the browser with no third-party QR service. ### What happens if I switch two-factor authentication off? Nobody’s setup is deleted, but 2FA stops being required and those accounts sign in with a password alone. A warning appears in the admin whenever enrolled users exist while the feature is off. ### Can username lockouts be abused? Yes. If username lockouts are enabled, an attacker who knows a username can burn through attempts and lock that account. Leave the option on only if that trade-off is acceptable, or keep important accounts on the username allowlist. ### Will forcing a password change lock members out? Members who must change their password cannot sign in until they complete a password reset. Make sure your site can send email reliably before enabling first-sign-in force-change or short expiry windows. ### What about Jetpack or the WordPress mobile app? Leave the XML-RPC setting on **Leave alone**. Disabling XML-RPC or stripping auth methods can break those services. ### Is Ulkoovi affiliated with Ultimate Member? No. Ulkoovi is an independent User Elements extension. It is not affiliated with, endorsed by, or maintained by Ultimate Member. ### What versions are required? Ulkoovi requires Ultimate Member 2.12.0 or newer, WordPress 6.5 or newer, and PHP 7.4 or newer. Version 1.0.2 is tested with WordPress 7.0. [Download Ulkoovi — Free](https://wordpress.org/plugins/ulkoovi-login-security/) [View documentation](https://www.userelements.com/docs/)Free GPL-3.0 · WordPress.org v1.0.2 · UM 2.12+ · WP 7.0 · Off by default License GPL-3.0 Version 1.0.2 Updated Aug 24, 2026 Included - All features in this release - WordPress.org updates - Privacy export & erase Support - [Documentation](https://www.userelements.com/docs/) - [Contact User Elements](https://www.userelements.com/contact-us/) Categories Security Membership Login Privacy Extension information - Ulkoovi Login Security 1.0.2 - Last updated: August 24, 2026 - PHP version required: 7.4+ - Requires Ultimate Member: 2.12.0+ - Requires at least WordPress: 6.5+ - Tested up to WordPress: 7.0 Quality checks - Third-party checks off until enabled - WordPress privacy export & erase - WP-CLI unlock if you lock yourself out