Locking the front door

Settings → Data & GDPR → Locking the front door. Pavilion holds every member’s name, address, telephone number and date of birth. The way a site like this is actually taken is not clever: somebody points a script at the login page and tries a few hundred thousand passwords, or at XML-RPC, where a single request can carry hundreds of guesses. WordPress on its own will let them try for ever.

👀 The rule everything here follows

It is aimed at the attacker and invisible to a member. A volunteer who mistypes their password twice must notice nothing — because if they do, the club will ask for it to be turned off, and then they are less safe than before it existed.

🐢 Slowing down wrong passwords

Five wrong tries buys a fifteen-minute pause. It is counted both by where the attempt came from and by which account it was aimed at, because a script trying one common password against every member in turn never trips a per-account limit — and one trying every password against one account never trips a per-address limit if it moves about. A good sign-in clears the count, so one forgetful evening costs nothing.

🤐 Not saying which half was wrong

WordPress will tell anybody whether the username exists, which turns one hard problem into two easy ones. A member who has genuinely forgotten is no worse off: the answer either way is the reset link on the same screen.

📋 Not handing out the usernames

Author archives and the built-in user list will both give away every account name to somebody who is not signed in at all. Nothing at a bowls club needs either.

🔌 XML-RPC

It exists for desktop blogging software nobody here has ever used, and its multicall method is the most efficient way there is to guess passwords at a WordPress site. Off unless something you actually use needs it.

🔑 A real password, of officers only

Twelve characters, not the club’s own name, and not one of the obvious words — for anybody who can see the membership records. Three unrelated words is fine and easy to remember.

Ordinary members are deliberately left alone. Somebody who can book a rink and read the noticeboard does not need a password rule, and a club that imposes one gets it written on the tablet by the door. Rules where they earn their keep, nowhere else.

⏸️ Who is paused right now

Under the settings on the same screen is a list of every account and address currently in a pause, by name, with a Lift button beside each. The login page is deliberately vague about the pause so that somebody guessing passwords learns nothing from it; the cost of that silence is that the club has to be able to see the same thing from the inside. If you recognise the name and they are standing in front of you, lift it. If you do not recognise it, leave it — that is the pause doing what it is for.

Anybody whose account is paused is also sent an email telling them so, and telling them the reset link will lift it. Without that, the honest explanation for being shut out never reaches the one person who needs it, and they spend the evening changing a password that was never being looked at.

🚪 If you are the one locked out

Three ways back, in order of how much trouble they are. Wait fifteen minutes — the pause really does end, and attempts made during it no longer push it further away. Use the “Lost your password?” link — a completed reset lifts the pause immediately, because whoever has just read the account’s email is not the person the pause is for. Changing the password any other way will not help: the pause is checked before the password is.

If neither is possible — no working email on the account, say — one line in wp-config.php turns the pause off until you take it out again:

define( 'PVL_DISABLE_LOGIN_GUARD', true );

Put it above the line that says “That’s all, stop editing”, sign in, sort the account out, then remove it. A club should never need this, but a club that does need it should not need a database console to get in.

📧 A sign-in from somewhere new

An officer signing in from an unfamiliar browser or connection gets one email saying so. Mentioned, not blocked — blocking locks people out of their own club on a new phone or on holiday, at the worst possible moment. It costs an honest officer one email the first time they use a new device, and it is the cheapest way a club ever finds out that a login has been taken.

🥇 The strongest thing you can do

A passkey. The phone or laptop signs in with a fingerprint or a face, and there is no password left to guess, to phish or to reuse somewhere it has already leaked. Officers can add one from their own profile. Everything on this screen is what protects the people who have not yet.

Common questions

Will this lock out our own members?

It should never be noticed by anybody typing their own password. Five wrong ones in an hour is not a forgetful member, it is a script — and a correct sign-in wipes the slate.

Somebody is locked out and needs in now.

Find them in Who is paused right now, on the same settings screen, and press Lift. If you cannot get to that screen either, the “Lost your password?” link on the login page lifts it as soon as the reset completes — and failing everything, it ends on its own after a quarter of an hour.

I changed the password three times and it still will not let me in.

Then it is not the password — you are in a pause, and it is checked before the password is ever looked at, so changing it cannot help. Wait fifteen minutes, or use the “Lost your password?” link, which lifts the pause the moment the reset completes. Attempts made during a pause no longer extend it.

We use something that needs XML-RPC.

Turn that one box back on. It is the only setting here with a real chance of breaking something you use — most often the Jetpack plugin or an old mobile app.

Why not require strong passwords of everybody?

Because it would not make the club safer. A member account can see the noticeboard and book a rink; an officer account can see everybody’s address and date of birth. Putting the same rule on both annoys three hundred people to protect nothing, and annoyed people write passwords down.

Is this instead of a security plugin?

It covers the part that matters most for a club and needs no setting up. A dedicated security plugin does more — a firewall, file scanning — and the two sit together perfectly well.