Anything that exposes lockout state to WordPress: Wordfence Login Security, Limit Login Attempts Reloaded, Solid Security (formerly iThemes Security), WP 2FA, miniOrange, and custom integrations with Auth0, Cognito, or Firebase. The bot reads the lockout state from the plugin's table or user meta, so adding a new provider is a matter of mapping fields.

Yes, if you expose an unlock endpoint as a tool. After identity proofing succeeds (correct billing zip, last 4 of payment method, correct recent transaction), the bot calls the endpoint to clear the lockout and tells the user to try logging in. For high-risk roles, you can require a human approval step before the unlock fires.

The security plugin already classifies it. Wordfence and Limit Login Attempts Reloaded both log the failure reason - wrong password, blocked IP, blocked country, captcha failure. The bot reads that signal and follows the right script: soft retry for a forgetful user, hard escalation for a sustained attack.

The bot does not unlock anything without identity proofing that the attacker does not have - billing zip, last 4 of the card on file, recent transaction details. For high-risk roles, no automatic unlock is possible at all; a human reviewer signs off. The system prompt also tells the model to refuse if the proofing signals do not match.

No, it filters them. The bot resolves the easy cases (waiting out a rate limit, sending a reset link) in the chat. The hard cases (lost email, suspected account takeover, executive accounts) still go to humans, but with the proofing data already collected and the transcript attached. Average time on a real reviewer's desk drops, not the count of reviewers.

Every turn is logged in WordPress with user ID (if known), timestamp, model, token count, and the source IP from the lockout event. Security teams can review patterns - which lockout types most often resolve in the bot, which require human escalation, which lead to repeat lockouts - and tune the system prompt or the underlying security rules.

Yes. Most teams keep the static reset link as a backup and route lockout-specific pages and 'too many attempts' redirects to the bot. The static link still works; the bot is the better path for anyone whose lockout is more nuanced than a simple forgotten password.

No. SleekAI is a one-time WordPress plugin license. You bring your own OpenAI, Anthropic, Google, or OpenRouter API key and pay the provider directly. A typical recovery conversation is well under a cent in tokens, compared to the labour cost of a human-handled lockout ticket.