How to Limit Login Attempts in WordPress

Why limit login attempts

1. A limit stops attackers from trying thousands of passwords.
2. Hackers often target known usernames or emails.
3. Many login attempts load your server.
4. A visible limit tells attackers your site is protected.

Method 1: Use a plugin

Popular plugins are Limit Login Attempts Reloaded, Wordfence Security and Loginizer.

1. In the WordPress admin go to Plugins > Add New.
2. Search for Limit Login Attempts Reloaded.

   

3. Click Install Now, then Activate.
4. Open the plugin settings.

   

Useful settings:

• Allowed attempts. For example 3 to 5 failed logins.
• Lockout duration. For example 20 minutes for the first lockout and longer for repeats.
• IP or account. Limit by IP address, by user account, or both.
• Notices. Edit the message that blocked users see, and turn on email alerts.

Method 2: Add code (advanced)

Without a plugin you need custom code that counts failed logins and blocks the IP. This is easy to get wrong. A plugin is the better choice for most people.

Another layer you can add on the server is to restrict wp-login.php by IP in .htaccess:

<Files wp-login.php>
    Require ip 203.0.113.10
</Files>

Replace the IP with your own. Use this only if you have a fixed IP, or you will lock yourself out.

More ways to protect the login

• Use strong passwords and two-factor authentication.
• Rename the admin user, and do not use admin.
• Keep WordPress, themes and plugins updated.
• Add a CAPTCHA to the login form.
• Use a firewall plugin or a web application firewall.

Quick recap

• Install a limit login plugin and set 3 to 5 attempts.
• Add two-factor authentication for better protection.