---
title: "FluentAuth: secure WordPress login with Google login"
description: "Protect the WordPress login page from brute force attacks and let readers sign in and sign up with Google, using the free plugin FluentAuth."
---

> Documentation Index
> Fetch the complete documentation index at: https://cuongthach.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# FluentAuth: secure WordPress login with Google login

On WordPress, the admin login page is the page most open to attack, so it needs stronger protection. But overdo it, with a very long and hard password, and you often end up forgetting that password yourself.

[FluentAuth](https://wordpress.org/plugins/fluent-security/?ref=cuongthach.com) is a free security plugin that helps you:

- Protect the login page from brute force attacks.
- Sign in to the site faster with Google, with no password to remember.
- Let people sign up as members (subscribers) with Google in one step.

## What do you need to get ready?

- **A WordPress website** where you can install plugins.
- **A Google account with two-factor authentication on**, to create the login keys in Google Cloud Console.

## Install and set up FluentAuth

After you install and activate FluentAuth, open its **settings** to harden your website.

- **Core security settings**
  - Turn off XML-RPC (recommended).
  - Turn off login through the API (if your site uses no outside service to sign in remotely).
  - Turn off the REST API (if no plugin on your site automates anything).

  If the site is an ordinary blog, turn off all three. If it uses automated logins, turn off only the first one.
- **Login security settings (against brute force)**
  - Login Try Limit. The default is `5`.
  - Time limit. The default is `30` minutes.
- **Extended Login Options:** best left off.
- **Other settings:** turn on the email alert when a new admin account is created, and block subscribers from the admin area. Save.

## Why not turn on magic link and two-factor authentication?

FluentAuth also offers magic link and two-factor authentication, but Cuong does not recommend them for beginners:

- **Magic link:** each time you sign in, the site emails you a link instead of asking for a password. It is slow and costs you time.
- **FluentAuth's two-factor authentication:** the code comes by email, so it is slow. Two-factor through an app is faster.

Turn on the new admin email alert instead. A hacker who gets in usually creates a new admin, and that alert reaches you.

## Why is signing in with Google safe?

For web apps today, signing in with Google is the best way: common, well liked, fast and safe.

- **No password to remember.** You only need one Google account, with two-factor authentication on.
- **The website gets limited rights.** Signing in with Google does not let the website or a hacker take your Gmail or your Google account.
- **It cuts spam.** Google sign-up already proves the email is real, so you can usually skip double opt-in. Google accounts can still be mass-created, so keep a light anti-bot layer such as [Cloudflare Turnstile](/docs/content-system/resources/website-tools/software/cloudflare-turnstile).

## Set up Login with Google in FluentAuth

1. **Create a project in Google Cloud Console**

   Go to [Google Cloud Console](https://console.developers.google.com/apis/dashboard?ref=cuongthach.com) and create a new project. Any name works.
2. **Set up the OAuth consent screen**

   When you go to create the key, Google first asks you to set up the consent screen. Fill in a name and the emails, agree and create. No review by Google is needed; you only fill in the details.
3. **Create an OAuth 2.0 key of type Web Application**

   Create an OAuth 2.0 key of type **Web Application**. You can use the website's name as its name. Add the Authorized redirect URL, typed exactly like this:

   ```text
   https://yourdomain.com/wp-login.php
   ```

   Once created, you get a **Google Client ID** and a **Google Client Secret**.
4. **Paste the keys into FluentAuth and turn on Google login**

   Copy both keys into FluentAuth under the **Social Login** tab. Save, turn on login with Google, then save again.

   FluentAuth changes the login page a little to add the Google button. The redirect options after login can stay off if you do not use them.

## How do you know Google login works?

Open the admin login page and choose sign in with Google. An admin account goes straight into the admin area. A new Google account is registered with the subscriber role.

If it fails, check the redirect URL and the two keys you pasted.

## How does the login limit protect the site?

With the default settings, anyone who fails to sign in 5 times is blocked for 30 minutes, like a phone that locks you out for a while after too many wrong passcodes. For a heavier hand, change it to 7 tries and 60 minutes, so an IP that goes over the limit is locked for 60 minutes.

In theory you could go further and turn off password login altogether. But with the login limit in place, the login page is already protected to a good degree.

## When is FluentAuth most useful?

FluentAuth protects the login page and lets readers sign up with the subscriber role. That makes it very useful for membership sites, sites with sign-up forms, or any feature that uses the subscriber role, because it keeps spam out.

You can run FluentAuth alongside other security plugins such as a firewall and backups.

Source: https://cuongthach.com/docs/content-system/resources/website-tools/wordpress/fluentauth/index.mdx