A360 Login Avatar Panel adds a randomized visual verification step after WordPress validates the username and password. It also monitors login activity, can temporarily block repeated failed attempts and can notify an administrator. It is an additional barrier—not a replacement for dedicated two-factor authentication.
LOGIN SECURITY CAPABILITIES
Key features
A visible login challenge combined with monitoring and access controls. It complements strong passwords and dedicated 2FA rather than replacing them.
+
Per-user avatar challenge
Assign a required visual choice only to selected WordPress users.
+
Randomized icon order
Change the position of avatars every time the login screen loads.
+
Post-password validation
Check the avatar only after WordPress validates the username and password.
+
Login activity monitoring
Review successful and failed authentication activity in the security report and dashboard widget.
+
Temporary IP lockouts
Temporarily block an address after repeated failed attempts according to the configured threshold.
+
Administrator alerts
Send an email when failures from one IP exceed the selected limit.
+
Safelist and denylist rules
Manage IP addresses, IP ranges and usernames that require explicit access treatment.
+
Optional XML-RPC blocking
Disable XML-RPC when Jetpack, mobile access and remote publishing are not required.
Why the WordPress login screen needs layered protection
A strong unique password remains essential, but it should not be the only control around an important administrator account. Automated tools can repeatedly test credentials, while leaked passwords can be reused across services. Good protection therefore combines password hygiene, updates, limited privileges, monitoring, lockouts and—where appropriate—two-factor authentication.
How the visual avatar challenge works
An administrator assigns an avatar to a selected user. During login, the user enters the normal WordPress credentials and selects the assigned image from a grid whose order changes on every page load. WordPress validates the username and password first; only then does the plugin check the avatar. This order avoids using the visual step to reveal whether a public username exists.
The plugin does not change WordPress passwords and does not store submitted passwords. A user can also be excluded from the panel by selecting “No panel” in the settings.
Monitoring, lockouts and access rules
- Successful and failed login activity reporting
- Temporary IP blocking after repeated failures
- Administrator email alerts after a configured threshold
- Safelist and denylist rules for IP addresses, ranges and usernames
- A dashboard security widget and settings report
- Optional XML-RPC blocking
XML-RPC blocking should only be enabled when the site does not depend on Jetpack, the WordPress mobile application or remote XML-RPC publishing.
How to configure the plugin
- Install and activate A360 Login Avatar Panel.
- Open Settings → Login Avatar Panel.
- Enable the panel and assign avatars only to the intended users.
- Set a reasonable failed-attempt threshold and lockout duration.
- Configure the administrator alert address.
- Review safelist and denylist rules carefully.
- Test a non-critical account before enabling the mechanism for all administrators.
Avatar panel, password and 2FA compared
For high-value administrator accounts, combine a password manager, unique passwords, a dedicated 2FA plugin, current WordPress updates and the monitoring features offered by A360 Login Avatar Panel.
Privacy and stored security information
Successful login counters store timestamps. Failed events can include the timestamp, IP address, attempted username, failure reason and browser user agent. These details support security monitoring and temporary blocking. The plugin does not store passwords, but the site owner should document login logging in the privacy policy and choose an appropriate retention approach.
Add a visible barrier and better login awareness
Use A360 Login Avatar Panel as one layer in a broader WordPress security strategy.
Frequently asked questions
Is the avatar panel real 2FA?
No. It is an additional visual challenge, not an independent second authentication factor.
Does it reveal valid usernames?
The avatar is checked only after successful password authentication.
Can XML-RPC be blocked?
Yes, but do not enable the option when Jetpack, the mobile app or remote publishing requires XML-RPC.