Does HackBlocker work with WordPress Multisite?

Unfortunately, HackBlocker is designed for single-site WordPress installations only. It cannot be network-activated across a Multisite (network) setup. If you wish to protect multiple subsites, you’ll need to install and activate HackBlocker individually on each one. We’re exploring full Multisite support in a future release - if this is critical for your workflow, please get in touch so we can discuss timelines and potential workarounds.

How do I renew my licence?

You’ll receive an email reminder 30 days before your licence expires, with a renewal link. Simply follow that link to renew for another year at your current rate. If you miss the reminder, you can also log in to your account dashboard on apps-and-plugins.co.uk and click Renew Licence next to HackBlocker.

What types of attacks does HackBlocker protect against?

HackBlocker guards against: Brute-force login attempts (rapid username/password guessing) XML-RPC pingbacks (common WordPress attack vector) Invalid username probes (stops bots trying default/weak usernames) All blocked attempts are logged for your review.

What is the lockout threshold for failed login attempts and non-existent usernames?

HackBlocker enforces a strict one-strike policy: any failed login - whether an incorrect password for a valid account or an attempt with a non-existent username - will immediately block that IP address. All blocked attempts (including the attempted username, IP and timestamp) are kept in a rolling log of your 100 most recent entries under Tools → HackBlocker Logs. Why block on first failure (including bogus usernames) ? This approach not only stops brute-force attacks dead in their tracks but also prevents “username enumeration” tactics - where attackers probe your site for valid account names. By cutting off all failed attempts instantly, you significantly reduce malicious traffic and preserve server resources.

Will HackBlocker impact my site’s performance?

HackBlocker is built for efficiency: all security checks run at the PHP level with no external API calls, and there’s no extra database overhead beyond logging. In our internal tests on a typical WordPress installation, we observed no noticeable impact on page-load times. Of course, actual performance can vary depending on your hosting environment, theme and other active plugins - but in almost every case, HackBlocker runs completely transparently.

How do I view blocked attempt logs?

All blocked login attempts are recorded in Tools → HackBlocker in your WordPress dashboard. There you can s croll through the most recent 100 entries, each showing timestamp, IP and attempted username

Great things are on the horizon

Something big is brewing! Our store is in the works and will be launching soon!