Spencer Taylor logo wide
Contact

Threshold Login Guard

Threshold Login Guard is a WordPress security plugin developed and maintained by Spencer Taylor of Threshold Solutions, a web design and development studio in South Jersey. It is installed on WordPress websites that I build and manage. It protects those sites' login pages from automated attacks, and gives their visitors a faster, safer way to sign in.

What Threshold Login Guard does

  • Blocks brute-force and credential-stuffing attacks on the WordPress login page using a math CAPTCHA and per-IP rate limiting.
  • Rejects sign-ups that use disposable email addresses or blocked usernames.
  • Lets the site owner brand and customize the login screen.
  • Provides an optional Sign in with Google button on the WordPress and WooCommerce login screens.

The plugin runs entirely on the website it is installed on. It has no cloud service, sends no telemetry, and loads no third-party scripts.

How Sign in with Google works

When someone visiting a site that runs Threshold Login Guard clicks Sign in with Google, the plugin begins a standard OpenID Connect (OAuth 2.0) sign-in with Google. Threshold Login Guard requests only two non-sensitive scopes:

  • openid — a stable, anonymous identifier for the Google Account.
  • email — the email address on that Google Account, and whether Google has verified it.

Threshold Login Guard does not request access to Gmail, Google Drive, Contacts, Calendar, Photos, or any other Google service. It cannot read, create, modify, or delete anything in a user's Google Account.

Once Google confirms the identity, the plugin matches the verified email address to a WordPress user account on that same website and signs the person in. If no matching account exists, the site owner can allow one to be created automatically. Administrators and editors are held to a stricter rule: Google sign-in is refused until they confirm their existing WordPress password once, which prevents anyone from attaching an outside Google account to a privileged account.

What Google information is stored, and where

Sign-in happens directly between the visitor's browser, the website being signed in to, and Google. No Google user data is transmitted to Spencer Taylor, to Threshold Solutions, or to any third party, and none is used for advertising or sold.

The only Google information retained is stored in that individual website's own WordPress database:

  • The email address from the Google Account, saved as the WordPress user's email address so the person can be recognised on return.
  • The Google account identifier (the OpenID sub value), saved so a returning user is matched to the correct account even if their email address later changes.

The short-lived Google token used to complete the sign-in is used once and discarded. It is never written to disk or stored in the database, and Threshold Login Guard does not request or keep refresh tokens, so it has no ongoing access to any Google Account.

A user can unlink their Google Account at any time from their WordPress profile page, or ask the site owner to delete their account, which removes the stored identifier and email address.

Threshold Login Guard's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Licence and availability

Threshold Login Guard is released under the GPL-2.0 licence. It is not sold in a public marketplace; it is installed and maintained by Spencer Taylor on websites he builds and manages, and updates are delivered from a self-hosted update server.

Support and contact

Threshold Login Guard is developed and supported by Spencer Taylor, Threshold Solutions, South Jersey, USA. For questions about the plugin, about Google sign-in, or to request deletion of data held about you, use the contact page.

Policies

Your use of Threshold Login Guard is governed by the Privacy Policy and the Terms of Service.