Stop account takeovers on your WooCommerce store. When a customer logs in from a new location or device, they confirm a 6-digit code sent to their email — with automatic IP blocking and a fully brandable verification page. Enterprise-grade login security without changing how your customers shop.
WooCommerce stores are a target for credential-stuffing bots and account takeovers. Standard WordPress login offers no defense once a password leaks. Woo Login Security watches every login and shuts the door the moment something looks wrong — while real customers breeze through.
A complete, self-hosted security layer for the WooCommerce My Account login — no theme edits, no third-party accounts.
Detects logins from a new city, region or country and asks for a 6-digit email code — with 15-minute expiry, auto-submit and paste support.
Codes are sent to the customer's email on file. No SMS costs, no authenticator app, no extra support tickets.
After 5 wrong codes, the offending IP is locked out for a configurable duration — from 1 minute up to 7 days.
Upload your logo, background and illustration, or add custom CSS. The verification screen becomes part of your store, not a generic wall.
Every successful login is stored with IP, city, region, country and device — with configurable retention and auto-cleanup.
A settings page under Settings → Login Security, a live blocked-IP log with Active/Expired status, per-IP unblock and one-click cleanup.
Most security prompts feel like a dead end. Woo Login Security lets you make the verification screen your own — so customers trust it and complete it.
Your code for YourStore is 4 8 2 9 1 5. It expires in 15 minutes.
Enter the 6-digit code we emailed you to finish signing in.
Previous: London, GB · Current: Berlin, DE. If this wasn't you, reset your password.
Too many attempts. Try again in 60 minutes.
Verification only triggers when it should — a genuinely new location or device.
Username and password, exactly as normal on your WooCommerce store.
It compares the current IP location against the last successful login.
Trusted, returning customers see zero friction and go to their account.
The customer is logged out and a 6-digit code is emailed to them.
They're signed in and returned to where they started — cart, checkout or account.
The IP is locked out; admins can review and unblock from the dashboard.
Where an account takeover means fraudulent orders, refunds and lost customer trust.
Where a compromised account puts recurring revenue and private content at risk.
Where leaked credentials can lead to piracy and unauthorized downloads.
Where customer accounts hold points or perks worth protecting from misuse.
Who has ever received an "I didn't make this order" support message.
Who want a reliable, brandable security layer to deploy across client stores.
What you're buying: Woo Login Security is a single WordPress / WooCommerce security plugin developed in-house by SellCodeApp. You purchase a license, download the plugin, and install it on your own WordPress site — you host and operate it entirely yourself. SellCodeApp is the sole developer and vendor of this plugin; we do not host it or access any data processed within your installation.
No. If a customer logs in from the same city as their last login, nothing changes — they go straight to their account. Verification only triggers on a genuinely new location or device.
Yes. It hooks into the standard WordPress login and the WooCommerce My Account login redirect, so it works with any theme or page builder — no shortcodes required.
Codes are valid for 15 minutes. If an email is delayed, the customer can retry login to receive a new code. The IP block only triggers after typing the wrong code 5 times in a row, not from email delays.
No measurable impact. The location lookup runs once per login with a 5-second timeout, and same-city logins skip the lookup entirely.
By default a free HTTPS provider that needs no signup. You can switch between six providers with automatic failover.
The plugin stores IP addresses and approximate location for security purposes (a legitimate interest under GDPR Article 6(1)(f)) with configurable retention. See our GDPR Policy.
An instant email with a download link to the plugin and your license key, plus documentation. Your subscription includes updates and support while active.
Install Woo Login Security and stop account takeovers before they start.