WeaselWorks security plugins support is simple: your security plugin stays in charge. WeaselWorks never replaces or redirects your WordPress login, and its own sign-in form steps aside when a security or two-factor plugin is active.
In short: you don't need to change anything. With a security plugin active, the WeaselWorks entry page links to the WordPress login, where your plugin's checks run as usual.
Security Plugins WeaselWorks Recognizes
- Wordfence
- Two Factor
- Solid Security
- All In One WP Security
- Limit Login Attempts
- Loginizer
- WPS Hide Login
And others like them. When one of these WeaselWorks security plugins is active, people sign in through your normal WordPress login, including any two-factor step.
WeaselWorks Always
- Leaves your login page alone
- Lets your 2FA step run
- Uses WordPress accounts and roles
- Keeps to its own pages
WeaselWorks Never
- Replaces wp-login.php
- Redirects another plugin's login
- Skips your security checks
- Changes your theme
Sign-In Attempt Limits
The WeaselWorks form has its own attempt limit: 5 wrong passwords per account means a 15-minute wait. When your security plugin handles sign-in instead, its own limits apply. For general advice on keeping WordPress safe, see WordPress's hardening guide.
Tip: the WeaselWorks sign-in page going to the WordPress login is on purpose when a security plugin is active. See Choosing How People Sign In for the other options.