Clockwork Control v1.8.1: Native Gatekeeper Login Protection, Retiring LLAR, and Full Frontend Overhaul

If you run WordPress maintenance plans for paying agency clients, you’ve almost certainly experienced this phone call:

“Aaron, I logged into my website to edit a blog post, and there’s a big red warning banner saying my site had 4,812 hacking attempts this week! Are we being hacked right now?!”

No, they aren’t being hacked. That’s just the normal background noise of automated bot scanners scraping wp-login.php on every public IP address on the internet.

For years, agencies like ours relied on popular WordPress plugins for brute-force defense and two-factor authentication. First, WordFence Login Security was shut down upstream, forcing agencies to scramble. Second, plugins like Limit Login Attempts Reloaded (LLAR) increasingly leaned into commercial upsells, third-party ads, and alarmist dashboard widgets designed to frighten website owners into upgrading to paid tiers.

We don’t want to scare our clients. Client retention is built on confidence, calm competence, and proactive care—not panic widgets and third-party advertising inside the client’s own administrative dashboard.

That’s why in Clockwork Control v1.8.0 and v1.8.1, we completed a comprehensive transition: moving entirely away from LLAR and WordFence to our native, self-hosted Gatekeeper engine and 2FA. And alongside this security migration, we executed a major developer experience overhaul, migrating our frontend to modular TypeScript and bundled Apache ECharts.

Here is the story behind the migration, how Gatekeeper works under the hood, and what’s new in v1.8.1.

1. Why We Retired LLAR (And The Problem With Scare Tactics)

Limit Login Attempts Reloaded served its purpose for a long time, but over recent releases its philosophy drifted further away from what agency operators need:

1. Intrusive Upsells & Ads: Promoting paid micro-clouds, premium CAPTCHA subscriptions, and promotional notices directly inside wp-admin.
2. Scare Tactics in the Dashboard: Prominent widgets detailing thousands of “failed login attacks” that confuse non-technical clients and trigger urgent, unnecessary support tickets.
3. Pressable & Managed Host Blind Spots: Legacy LLAR lockout ingest in Clockwork Control relied on direct MySQL queries via SSH. On managed environments like Pressable or serverless setups without direct SSH or database access, LLAR operated as an opaque black box.

Security for agency websites should be silent, headless, and bulletproof. The client shouldn’t see it, bots shouldn’t bypass it, and the agency should have complete, centralized visibility across their entire fleet.

2. Introducing Gatekeeper: Native, Silent Login Defense

Gatekeeper is Clockwork Control’s native login protection and brute-force throttling engine. It ships directly inside Clockwork Companion 1.39.1+ and Clockwork Renegade 1.0.4+, with zero external plugin dependencies.

[Attacker Bot] ──(POST wp-login.php)──> [WordPress]
                                              │
                                    Gatekeeper (Priority 5)
                                              │
                      ┌───────────────────────┴───────────────────────┐
                      │                                               │
             [Normal Attempt]                                  [Locked IP]
                      │                                               │
              Passes to bcrypt                                   HTTP 429
             Password Validation                             (Exits Instantly,
                                                             Zero CPU Wasted)
                                                                      │
                                                        [Clockwork Control Ingest]
                                                        (HMAC REST / MySQL Relay)
                                                                      │
                                                            [fail2ban Jail]
                                                        (Linux iptables Drop)

Key Architectural Highlights:

• Priority-5 Interception: Gatekeeper hooks WordPress’s authenticate filter at priority 5—well before core password hashing runs at priority 20. If an IP is locked out, the request terminates immediately with an HTTP 429 response. Your server’s CPU does not waste cycles computing expensive bcrypt hashes for automated bot floods.
• Zero Client-Facing UI: No ads. No upsells. No scary widgets. The client’s dashboard remains pristine and white-labeled.
• Direct fail2ban Bridge: When an IP triggers repeated lockouts, Clockwork Control automatically pulls the lockout and fires an SSH command to fail2ban on the host server. The malicious IP is banned directly at the Linux kernel firewall (iptables)—dropping packets before they ever touch Nginx or PHP-FPM again.
• Signed HMAC REST for Serverless & Pressable: On hosting platforms without direct SSH or MySQL access (like Pressable), Gatekeeper exposes a cryptographically signed REST endpoint (/wp-json/clockwork/v1/lockouts). Clockwork Control pulls active lockouts effortlessly into the central Review Queue.
• 100% Fleet Rollout Verified: We completed our fleet migration across 88 out of 88 targeted client sites. Companion was verified, per-site Gatekeeper configurations were locked in, LLAR was deactivated, and plugin files were cleanly deleted.

3. Control Panel Frontend Overhaul: Modular TypeScript & Bundled ECharts

While finalizing Gatekeeper, we turned our focus inward to the Clockwork Control panel itself. For high-velocity agency operations, the user interface must be clean, maintainable, and blistering fast.

The Problem With Monolithic Inline Scripts

Over successive feature releases, several key views (such as the Sites directory, Traffic analytics, and WordPress Plugins manager) had grown substantial inline <script> blocks embedded directly inside Blade templates. Furthermore, several analytics tabs were loading Chart.js and date-fns over external CDNs (cdn.jsdelivr.net).

If an agency operator worked on a private network, or if an upstream CDN experienced a DNS hiccup, dashboard charts could fail to render.

What We Shipped in v1.8.1:

1. Lean Bootstrapper (resources/js/app.js): Reduced the application entry point to a concise 48-line orchestrator that imports modular components and boots Alpine.js.
2. TypeScript Component Extraction:
   • sitesPage (sites-page.ts): Fast client-side filtering, debounced server fetch, keyboard navigation (/ quick search), and connection key decoding.
   • wpPluginsManager (wp-plugins-manager.ts): Real-time asynchronous plugin status polling, companion installation, and Gatekeeper state rendering.
   • trafficCharts, performanceTrendChart, and serverMetricsChart: Tree-shaken Apache ECharts components with automatic resize listeners and clean $cleanup unmount hooks to prevent memory leaks.
3. Eradication of External CDN Scripts: 100% of charts across Traffic, Performance, and Server Stats now use local, bundled, tree-shaken Apache ECharts. Zero external CDN scripts remain.
4. Developer Tooling & Sub-4-Second Quality Gates:
   • Biome: Replaced heavy legacy linters with Biome, running code checks across 20 files in just 50ms.
   • TypeScript Compiler (tsc): Full type safety for all new modules and global window declarations (index.d.ts).
   • Unified composer check: Executes Pint (PHP style), PHPStan (static analysis, 0 errors), Biome, and tsc in 3.5 seconds.
   • Hardened 5-Layer Pre-Commit Hook: Combines filename guards (.env*, *.swp), local client denylists, staged gitleaks secret scanning, Pint, and Biome + tsc.
5. Full Architecture Invariant Testing: Our Pest architecture test now asserts that all 31 provider and feature module ServiceProviders cleanly extend ModuleServiceProvider.

4. How to Update

Clockwork Control v1.8.1 is available now on GitHub:

git fetch --tags
git checkout v1.8.1
composer install --no-dev --optimize-autoloader
npm run build
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan view:cache

Once updated, run our verification command to ensure your fleet is healthy:

php artisan clockwork:verify-canary-health --all-installed

Migrating Sites from LLAR to Gatekeeper

If you still have client sites with LLAR installed, run the automated rollout command:

php artisan clockwork:gatekeeper-rollout --scope=all --force

This will automatically ensure Clockwork Companion 1.39.1+ is active, persist the Gatekeeper per-site override, push the configuration, deactivate LLAR, and remove the legacy plugin files.

What’s Next

With Gatekeeper active across our entire fleet and the frontend modularized in TypeScript, our next milestones focus on expanded community module submission workflows and automated backup verifications.

As always, Clockwork Control is 100% open source under the MIT license. Check out the project on GitHub, join our community, and build your agency on your own terms.