Configuration Reference

All LoginPlus options are stored in the WordPress Options table. You can read or update them with get_option() / update_option().

Option key	Type	Default	Description
lp_brute_force_enabled	bool (0/1)	1	Enable brute force lockout
lp_max_attempts	int	5	Failed attempts before lockout
lp_lockout_duration	int (seconds)	900	Lockout window length
lp_allowlist_ips	string	“”	Newline-separated IPs (IPv4 or IPv6) exempt from lockout
lp_logging_enabled	bool (0/1)	1	Enable activity logging
lp_log_retention_days	int (days)	90	Log entries older than this are auto-deleted daily
lp_hash_ip_addresses	bool (0/1)	0	Store IPs as SHA-256 hashes instead of plain text
lp_2fa_enabled	bool (0/1)	0	Enable TOTP 2FA globally
lp_2fa_required_admins	bool (0/1)	0	Force 2FA for administrators
lp_google_login_enabled	bool (0/1)	0	Enable Google OAuth button
lp_google_client_id	string	“”	Google OAuth client ID
lp_google_client_secret	string	“”	Encrypted Google client secret
lp_email_alerts_enabled	bool (0/1)	1	Send email on suspicious logins and lockouts, to the site’s Admin Email

Note: lp_google_client_secret is stored AES-256-CBC encrypted — but only when the openssl PHP extension is available; otherwise it’s stored base64-encoded, not encrypted. Do not set it directly with update_option() — use the LoginPlus Settings page, which handles the encryption before saving.

There’s no separate “alert email” option — email alerts always go to whatever address is set as the site’s Admin Email under Settings → General.

Internal-only options

These two are used internally and are not registered with the WordPress Settings API — treat them as read-only:

Option key	Purpose
lp_wizard_complete	Set to 1 once the Setup Wizard has been saved or skipped, so it won’t show again
lp_db_version	Tracks the activity-log table’s schema version for future upgrades