Ulkoovi – Login Security for Ultimate Member

Spam registrations, brute-force logins, two-factor & password policy

Close the two doors into your membership site — registration and login — with Turnstile, 2FA, lockouts, ban lists and password rules. Most protections stay off until you turn them on.

Last updated: · Version 1.0.2

Version 1.0.2 Requires UM 2.12+ Tested with WordPress 7.0 GDPR export & erase Off by default

  • Stop spam signups with Stop Forum Spam, Akismet, and Cloudflare Turnstile
  • Lock out brute-force attacks on Ultimate Member, wp-login.php, WooCommerce and XML-RPC
  • Authenticator-app 2FA with hashed recovery codes — QR drawn in the browser
  • Password expiry, reuse history, first-sign-in force change, and session caps
  • Security Log with one-click unlock; WP-CLI escape hatch if you lock yourself out

Ulkoovi (Finnish for outer door) hardens the two doors into an Ultimate Member site: registration and login. Ultimate Member stores the current profile and handles forms; it does not, on its own, rate-limit failed passwords across wp-login.php, challenge bots on register, or give members an authenticator app.

Ulkoovi adds those controls in one settings screen inside Ultimate Member. Third-party spam checks stay opt-in so nothing leaves your site until you say so. This plugin is an independent User Elements extension — not affiliated with Ultimate Member.

What’s in version 1.0.2

Lockout and 2FA attempt counters increment atomically, so parallel requests cannot skip counts during a brute-force burst. Plugin URI now points at the public site homepage.

Stop spam before it becomes a member

Layer checks on Ultimate Member registration forms. Each service is off until you enable it, and each one is disclosed under Settings → Privacy when it is on.

  • Stop Forum Spam — optional checks on email, IP and username, with a confidence threshold, age filter, and fail-open when the API is unreachable.
  • Akismet — a second layer when the Akismet plugin is installed with a valid API key.
  • Cloudflare Turnstile — free bot challenge on Ultimate Member register, login and password-reset forms, plus wp-login.php. Theme, size and appearance controls included.
  • Ban lists — extends Ultimate Member’s blocked IP, email and word lists with CIDR and wildcard IP matching, and can enforce those bans at login as well as registration.

Lockouts that cover the whole site

Failed-login limits run on WordPress’s authenticate filter. Ultimate Member forms, wp-login.php, WooCommerce and XML-RPC all count toward the same window. Configure max attempts, attempt window, short lockout, and an extended lockout after repeated lockouts. Allowlisted IPs and usernames skip lockouts and selected spam checks.

Two-factor without a third-party QR service

Members enrol an authenticator app from their Ultimate Member account. Recovery codes are hashed and shown once. The challenge is rate-limited after a correct password, on both Ultimate Member login and wp-login.php. Admins can view status and remove 2FA from the user profile. The QR code is drawn locally in the browser.

Password, session and network policy

  • First sign-in — force a password change after registration.
  • Expiry & reuse — expire passwords after a set number of days; block reuse of recent passwords.
  • Sessions — cap concurrent signed-in sessions per user (optionally exclude administrators).
  • Proxy-safe IPs — trust forwarded headers only when the request arrived from an address on your Trusted proxies list (Cloudflare CF-Connecting-IP, X-Forwarded-For, X-Real-IP, or REMOTE_ADDR).
  • XML-RPC — leave alone, strip password-requiring methods, or disable entirely. Keep “leave alone” if you use Jetpack or the WordPress mobile apps.

Locked out? Open Ultimate Member → Security Log and press Release all lockouts. If you cannot reach wp-admin, run wp ueas-security unlock.

Included at a glance

Features included in Ulkoovi Login Security
Capability Included
Stop Forum Spam on registration✓
Akismet registration check✓
Cloudflare Turnstile on UM forms & wp-login.php✓
Site-wide failed-login limits & escalating lockouts✓
UM ban lists with CIDR / wildcards & login enforcement✓
TOTP 2FA with hashed recovery codes✓
Password expiry, history & first-sign-in force change✓
Concurrent session caps✓
Trusted-proxy IP detection✓
XML-RPC hardening modes✓
Security Log + WP-CLI unlock / prune✓
WordPress privacy export & erase✓

Works with

  • Ultimate Member — settings live under Extensions; ban lists stay in Access. Requires 2.12.0 or newer.
  • WordPress authentication — lockouts apply anywhere passwords are checked, including WooCommerce login.
  • WordPress Privacy Tools — personal-data exporter and eraser for Security Log rows, plus suggested privacy-policy text.

Requirements

  • Ultimate Member 2.12.0+
  • WordPress 6.5+ (tested with 7.0)
  • PHP 7.4+

Common questions

Does Ulkoovi require Ultimate Member?

Yes. It is an extension for Ultimate Member 2.12.0 or newer and will not load without it.

Does the login limit protect wp-login.php and WooCommerce?

Yes. Enforcement runs on WordPress’s authenticate filter, which covers Ultimate Member forms, wp-login.php, WooCommerce, XML-RPC, and other password entry points.

I locked myself out. How do I get back in?

If you can still reach wp-admin, open Ultimate Member → Security Log and press Release all lockouts. If you cannot, run wp ueas-security unlock over WP-CLI or SSH.

Does Ulkoovi send visitor data to third parties?

Only if you turn a service on. Stop Forum Spam, Akismet and Cloudflare Turnstile are off by default. Enabling any of them sends data to that service — review your privacy policy first. Suggested wording is added automatically under Settings → Privacy.

Does Cloudflare Turnstile cover WooCommerce login?

No. Turnstile is available on selected Ultimate Member forms and on wp-login.php. Login attempt limits and ban lists still apply to WooCommerce through WordPress authentication.

Where do I edit ban lists?

Under Ultimate Member → Settings → Access → Other. Ulkoovi extends those lists with CIDR and wildcard IP matching and optional login enforcement. It does not keep a second copy. Lists from older versions of this plugin are merged into the Ultimate Member lists on upgrade.

Does Ulkoovi store passwords?

No. Ulkoovi does not log passwords. Two-factor secrets stay on the site; recovery codes are hashed; the enrolment QR code is drawn in the browser with no third-party QR service.

What happens if I switch two-factor authentication off?

Nobody’s setup is deleted, but 2FA stops being required and those accounts sign in with a password alone. A warning appears in the admin whenever enrolled users exist while the feature is off.

Can username lockouts be abused?

Yes. If username lockouts are enabled, an attacker who knows a username can burn through attempts and lock that account. Leave the option on only if that trade-off is acceptable, or keep important accounts on the username allowlist.

Will forcing a password change lock members out?

Members who must change their password cannot sign in until they complete a password reset. Make sure your site can send email reliably before enabling first-sign-in force-change or short expiry windows.

What about Jetpack or the WordPress mobile app?

Leave the XML-RPC setting on Leave alone. Disabling XML-RPC or stripping auth methods can break those services.

Is Ulkoovi affiliated with Ultimate Member?

No. Ulkoovi is an independent User Elements extension. It is not affiliated with, endorsed by, or maintained by Ultimate Member.

What versions are required?

Ulkoovi requires Ultimate Member 2.12.0 or newer, WordPress 6.5 or newer, and PHP 7.4 or newer. Version 1.0.2 is tested with WordPress 7.0.

Scroll to Top