SecondGate

This plugin’s free tier is permanent: passkeys, 2FA, brute-force protection, and country blocking are all included, with no artificial limitation and no time-limited trial.

At a glance

• Passkeys (WebAuthn) — Face ID, Touch ID, Windows Hello, or a hardware key, bound to your exact domain so it can’t be phished
• Standard TOTP two-factor authentication — works with Google Authenticator, Authy, 1Password, Bitwarden, and any other standard authenticator app
• Trusted devices — skip the 2FA prompt on a recognised device for 30 days, one click to forget it
• Brute-force login protection — automatic IP and username lockout after repeated failed attempts, never locking out the real account owner
• Country blocking — blacklist or whitelist, 166 countries, IPv4 + IPv6, matched locally against downloaded range data, no third-party lookup at request time
• Verified crawler exemption — Googlebot, Bingbot, and other real search crawlers are automatically exempt from every block, confirmed via reverse+forward DNS rather than a fakeable user-agent string, so a blocking rule doesn’t accidentally catch a genuine crawler

Why it works differently under the hood

Every check runs locally, on your own server. No API keys, no third-party accounts, no telemetry sent anywhere. Country IP range data is downloaded once a day from public sources and matched against visitors entirely on your own site — nothing about your traffic is ever sent to us or anyone else.

Two-factor authentication is generated and verified entirely on your own server too. TOTP codes and passkey credentials never leave your site.

The one thing worth knowing about crawler verification

Blocking traffic by country is only safe if it can’t accidentally catch Google. Most plugins check this by trusting whatever a visitor’s browser claims to be — but any visitor can set their User-Agent to say “Googlebot,” which means that check can be bypassed by anyone, and doesn’t actually protect your SEO the way it looks like it does.

This plugin verifies real crawlers properly instead: a reverse-DNS lookup on the connecting IP, confirming the hostname belongs to the crawler’s real network, then a forward-DNS lookup confirming that hostname resolves back to the same IP. That’s the method Google’s own documentation recommends for verifying a crawler is genuine — not a name anyone could fake.

External Services

This plugin connects to two external sources, both required for the plugin to function, both with no account or API key:

GitHub (raw.githubusercontent.com) — for downloading country IP range data used by country blocking. A plain GET request for a static public file, fetched once daily and matched locally afterward. No data about your site or its visitors is sent as part of this request.

DNS lookups (not an HTTP call to any specific company) — when a visitor’s browser claims to be a known search crawler (Googlebot, Bingbot, etc.), this plugin performs a standard reverse+forward DNS lookup on that visitor’s IP, using your server’s normal DNS resolver, to verify the claim is real before exempting it from blocking. This is the same kind of lookup any web server does routinely; no data about your site or its visitors is sent anywhere as part of it.

Two-factor authentication makes no external service calls whatsoever — TOTP codes and passkey verification happen entirely on your own server.

GitHub’s terms: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service