UniLogin 1.2 is an authentication plugin for Joomla that lets visitors sign in with an email address or username in the same login field. It maps email to the account, verifies the password with Joomla’s native hashing, and adds rate limiting, attempt logging, domain/group rules, custom messages, and optional post-login redirects.

Version 1.2 hardens the auth path: no nested Authentication - Joomla plugin, Joomla 5 event signatures, bound SQL lookups, timing-safe misses, and stopPropagation on success.

Key highlights:

• Joomla 4, 5 & 6 compatible
• Email and/or username login (Username Fallback)
• Rate limit + temporary lockout
• Login attempt logging with retention
• Domain whitelist / blacklist
• User group restrictions
• Custom error messages
• Default and per-group redirects
• Custom field label and placeholder

Download

After purchase, download plg_authentication_unilogin_1.2.zip from your store account or the download email.

Install

1. Log in to the Joomla administrator
2. Go to System > Install > Extensions
3. Upload plg_authentication_unilogin_1.2.zip
4. Go to System > Manage > Plugins
5. Open Authentication - UniLogin and enable it
6. Keep core Authentication - Joomla enabled as well
7. Clear Joomla cache

The installer creates the #__unilogin_attempts table used for rate limiting and logging.

Requirements

• Joomla 4, 5, or 6
• PHP 8.1 or newer recommended
• Core Authentication - Joomla plugin enabled

Tip: Place UniLogin earlier in the authentication plugin order (lower ordering number) so email login is handled before the core username check.

Open System > Manage > Plugins > Authentication - UniLogin. Use the Basic tab.

• Username Fallback — Yes (default): accept email or username. No: UniLogin only handles email; username login is left to other auth plugins.
• Custom Login Field Label — replaces the Username label on com_users login (e.g. Email or Username). Leave empty for the default label.
• Custom Login Field Placeholder — hint text inside the field (e.g. Enter your email or username). Leave empty for none.

Save and enable the plugin. Existing login forms and the Login module work without template changes.

Optional language override: You can still override COM_USERS_LOGIN_USERNAME_LABEL or MOD_LOGIN_VALUE_USERNAME under System > Manage > Language Overrides if you prefer not to use the plugin label fields.

Use the Security & Logging tab.

Rate limiting

• Enable Rate Limiting — turn brute-force protection on or off (default On)
• Maximum Failed Attempts — failures before lockout (default 5; range 1–20)
• Lockout Duration — minutes locked after the limit (default 15; range 1–1440)

Failed attempts are counted by identifier (email/username) and IP. A successful login clears prior failed rows for that identifier/IP.

Logging

• Enable Login Logging — store attempts in #__unilogin_attempts (default On)
• Log Retention Period — days to keep rows (default 30; range 1–365); older rows are deleted automatically

Each row stores: identifier, IP address, timestamp, status (success, failed, locked), and user ID when known.

View logs with phpMyAdmin or any SQL tool. There is no admin list view in the plugin itself.

Use the Access Restrictions tab.

Email domain restrictions

• Enable Domain Restrictions — off by default
• Restriction Mode
  • Whitelist — only listed domains may log in
  • Blacklist — listed domains are blocked
• Allowed Domains — one domain per line, no @ (e.g. company.com)
• Blocked Domains — shown in blacklist mode; same format

Matching is case-insensitive on the domain part of the email.

User group restrictions

• Enable Group Restrictions — off by default
• Allowed User Groups — multi-select; only users in at least one selected group may authenticate via UniLogin

Use this when only certain roles should sign in with email.

Custom error messages

On the Custom Error Messages tab, leave a field empty to use the default language string.

• User Not Found Message
• Invalid Password Message
• Account Locked Message
• Domain Blocked Message

Login redirects

On the Login Redirect Settings tab:

• Enable Custom Redirect — set users.login.form.return after a successful UniLogin auth
• Default Redirect URL — examples: /dashboard, index.php?option=com_users&view=profile, or a full internal HTTPS URL
• Enable Group-Specific Redirects — optional rules that override the default when the user’s group matches
• Group Redirect Rules — repeatable rows: choose a group and a redirect URL

URL rules: Relative paths (starting with /) and index.php… routes are accepted. Absolute http(s):// URLs must be on this site. Protocol-relative //… URLs are rejected.

Authentication

• Email → username remap with native UserHelper::verifyPassword
• Optional username fallback in the same field
• Custom login label and placeholder via form prepare

Security

• Rate limit and lockout by identifier + IP
• Attempt logging with automatic retention cleanup
• Domain whitelist / blacklist
• Group allow-list
• Bound queries and timing-safe handling on unknown users

After login

• Default redirect URL
• Per-group redirect rules
• Open-redirect protection for external absolute URLs

Platform

• Joomla 4 / 5 / 6
• en-GB language packs for admin and site strings
• Installer script + attempts table

• Which Joomla versions are supported?

  • Joomla 4, 5, and 6. PHP 8.1+ is recommended. UniLogin 1.2 is the current release.

• How do I show “Email or Username” on the form?

  • Set Custom Login Field Label in the plugin Basic tab, or use a language override for COM_USERS_LOGIN_USERNAME_LABEL / MOD_LOGIN_VALUE_USERNAME.

• Should I disable Authentication - Joomla?

  • No. Keep it enabled. UniLogin handles email (and username when Fallback is on); the core plugin remains part of a healthy auth stack.

• How does rate limiting work?

  • After the configured failed attempts, further tries receive a lockout message until the lockout minutes expire. Success clears the failed count for that identifier/IP.

• Where are login logs stored?

  • In #__unilogin_attempts. Inspect with a database tool; there is no component UI.

• Can different groups land on different pages?

  • Yes — enable custom redirect, turn on group-specific redirects, and add rules (group + URL).

• Does this change registration (email-only signup)?

  • No. UniLogin is login-only. For registration without a separate username, use Registration Simplifier.

• Where can I get help?

  • support.joomlax.com

• Email login does nothing / fails

  • Confirm Authentication - UniLogin is enabled and ordered before Authentication - Joomla. Confirm the email matches an unblocked user. Check domain and group restrictions.

• Username login fails when Fallback is off

  • Expected for UniLogin — turn Username Fallback on, or rely on Authentication - Joomla for username-only login.

• Label still says Username

  • Save the plugin params. Custom label applies to the com_users.login form. Hard-refresh or clear cache. For some module layouts, use a language override as well.

• Account locked

  • Wait for lockout duration, or delete matching rows from #__unilogin_attempts. Raise Max Attempts / Lockout Duration if legitimate users hit the limit.

• Redirect ignored

  • Enable Custom Redirect and set a valid internal URL (/path, index.php?…, or same-site absolute URL). External absolute URLs and //… URLs are rejected.

• Attempts table missing

  • Reinstall/upgrade the plugin so script.php runs, or create the table from the installer SQL.

• Failed login lands on a 404

  • Usually a site menu/SEF issue (no dedicated Users login menu item), not UniLogin. Create a published Login menu item or fix the Users component menu. Auth and logging still work.