# How To See Who Is Trying to Sign in With BetterShield?

See the networks and usernames that failed sign-ins used most over the last 7 or 30 days, and block a tried name in one press.

In **[BetterShield](/)**, **Recent sign-in attempts** is a card on **BetterShield › Protection › Login & Access**, directly below **Your connection and lockouts** and above **Sign-in protection**.

## What it does

Every failed sign-in is already in the activity log. This card adds them up for the last 7 or 30 days, so you can see that one network made most of the attempts, or that bots are working through names like `admin`. It stores nothing new, and it can only count what the log keeps, which is 30 days in the free plugin.

- **Period** switches between **7 days** and **30 days**. The default is **7 days**.
- A line under it reads, for example, "120 failed sign-ins in the last 7 days." With none it reads "No failed sign-ins in the last 7 days."
- **Top networks** lists the five networks with the most tries. A network is shown as a /24 (IPv4) or /64 (IPv6), never a full address. Each line ends with a count, such as "42 tries". If none could be read it says "No network could be read."
- **Names tried** lists the ten names tried most, each with its count.

Where a burst of tries is stored as one log row, the extra attempts it stands for are added to its network, and each extra name counts once.

Each line is a link. A network opens **Site activity** narrowed to that network, and a name opens it with that name in the search box, both from the first day of the period.

### Marks and the Block button

- **Account** marks a name that belongs to someone on this site.
- **Blocked** marks a name already refused from every network.
- **Block** appears on a name that is neither. Its accessible name is "Block [name] from signing in".

Only a person who may list this site's users sees **Account**, **Blocked** and **Block**. They can already read every username on the Users screen, so this gives nothing away. Anyone else sees the counts and names without marks. The note under the lists reads "Account marks a name that belongs to someone on this site. A blocked name is refused from every network."

A name has no **Block** button when it is an account, is blocked already, or is written in a way the list would store differently, such as an email address.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Open BetterShield › Protection › Login & Access

Open **BetterShield › Protection › Login & Access** and find **Recent sign-in attempts**.

<figure class="doc-shot">
  <img src="/docs/screenshots/login-and-access.png" alt="Login & Access with the Recent sign-in attempts card listing Top networks and Names tried." width="1032" height="950" loading="lazy" decoding="async">
  <figcaption>The card adds up failed sign-ins so one busy network or one guessed name stands out.</figcaption>
</figure>

## Step 2: See who is trying to sign in

- Choose **7 days** or **30 days**.
- Read **Top networks** and **Names tried**. Select a line to see the matching activity.
- Press **Block** beside a name that nobody on the site should use.

**Block** saves at once. The screen says "Blocking [name]…" and then "[name] is blocked from signing in." It adds a username-only entry to **Never allowed to sign in**, with no **Note**, and you do not need the Save bar.

| Option | What it does | Default |
| --- | --- | --- |
| **Period** | **7 days** or **30 days** | **7 days** |
| **Block** | Adds the name to **Never allowed to sign in** | Nothing blocked |

## Recommended settings

Our advice is to look at it weekly and block names that no account here uses, such as `admin` on a site with no `admin` account. A network line has no **Block** button, so a range needs a deliberate entry on **Never allowed to sign in**. Check a range before you save it. See [Allow and block lists](/docs/allow-and-block-lists/).

## What it can break and how to undo

A blocked username is refused at sign-in from anywhere. While **Sign-in attempt limits** is on, whoever tries it on a verified connection is locked out on the first try, unless the address is on **Always allowed**. Real accounts never get the button, so you cannot block one by mistake here.

To undo, remove the entry from **Never allowed to sign in** and press **Save**. With password confirmation on, removing a block asks for your password.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

After you press **Block**, the line shows **Blocked** and the name is on **Never allowed to sign in**. The activity log records "Login protection changed".

<figure class="doc-shot">
  <img src="/docs/screenshots/login-and-access.png" alt="Login & Access with the Recent sign-in attempts card listing Top networks and Names tried." width="1032" height="950" loading="lazy" decoding="async">
  <figcaption>Example Recent sign-in attempts view. Check the saved values and status on your own site.</figcaption>
</figure>

## On multisite

Each site counts its own attempts and keeps its own list.

## Related

- [Login & Access](/docs/login-and-access/)
- [Allow and block lists](/docs/allow-and-block-lists/)
- [Sign-in lockouts](/docs/sign-in-lockouts/)
- [Filter and search site activity](/docs/filter-activity-log/)

This is how you can see who is trying to sign in with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).