Rublon

Botnets carry out brute-force attacks against thousands of WordPress sites and blogs every day, regardless of size. Once inside, botnets infect your visitors with malware. A compromised website leads to delisting by search engines or blocking by your hosting provider. Rublon Multi-Factor Authentication (MFA) prevents such attacks.

Many people use simple, easy-to-guess passwords which can be easily broken or stolen. If you use the same password across multiple devices, services, or on unsecured connections, such as public Wi-Fi networks, you are an easy target for hackers. Botnets can attempt to compromise WordPress sites by using millions of common passwords and character combinations.

Rublon Multi-Factor Authentication (MFA) adds an extra layer of security on top of your usual login & password WordPress logins. First, a user enters their username and password as always. Then, Rublon displays the Rublon Prompt. The user can select one of the available authentication methods, such as Mobile Push or WebAuthn/U2F Security Key. After selecting and completing the authentication method, the user gains access to WordPress.
The Rublon Prompt also allows users to self-enroll their mobile device or security key if they have not already. Further, thanks to the Rublon Prompt, the user can check the Remember this device checkbox to bypass MFA during subsequent logins on a selected device.

Rublon is simple and user-friendly. Activate the plugin, enter the System Token and Secret Key from the Rublon Admin Console, and you’re done. Your users don’t have to install or configure any additional software. Rublon is so simple to use that your users won’t need training. Once they confirm their identity on a device, they can choose to remember this device and log in by only entering their WordPress password.

Traditional Multi-Factor Authentication solutions demand users to enter a one-time password each time they want to log in. That’s why people don’t like them. Rublon is different. With Rublon, you confirm your identity by clicking a link, tapping a push notification on your phone, or touching a FIDO security key. Rublon doesn’t force you to type anything on your keyboard and gives you many authentication options to find your favorite.

Rublon Multi-Factor Authentication is an all-in-one package that contains Rublon MFA for WordPress and dozens of other products, applications, and integrations. You can start a Free Rublon Trial and enjoy all features for 30 days. If you only want to protect one WordPress account, you will never have to pay! For more information, visit our Pricing page.

Simply install the Rublon for WordPress plugin and activate it. Then, create a new WordPress application in the Rublon Admin Console and copy the values of the System Token and Secret Key. For full detailed instructions (including screenshots), refer to our Documentation.

Yes! Just install the Rublon Authenticator mobile app on your phone (available for Android and iOS). After entering your WordPress login credentials, you will be prompted to verify your account in one of the following ways:
* Enter the TOTP code (Time-Based One-Time Password)
* Scan a QR code
* Confirm login using a push notification
* Copy the verification code from the SMS sent to your mobile number

No. You can choose which users you want to protect. You can protect everyone or only select groups of users. You can use Group Policies to decide who is protected and how, including which authentication methods Rublon should allow and logins from which IP ranges Rublon should bypass.

No. Rublon never knows your credentials or those of your users. They are never transmitted to our servers. Rublon does its work in the background only after WordPress verifies your password. It’s an independent security layer that sits beneath the login form.

The Rublon Authenticator mobile app holds your digital identity with your private encryption key, which never leaves your phone. With any action requiring the mobile app, such as confirming your identity, the Rublon app generates a unique encrypted digital signature. Gaining access to an email account without multi-factor authentication is easier than stealing your private key from your phone and reusing it.