Limit Login Attempts

The Limit Login Attempts module protects your WordPress site from brute-force attacks by restricting the number of failed login attempts from each IP address. Once the limit is reached, the IP is temporarily blocked, reducing the risk of unauthorized access. You can configure attempt limits, lockout duration, and admin notifications for added security.

How to use

To enable the Limit Login Attempts module:

1. Click on the “Security” category
2. Search or scroll to locate the Limit Login Attempts module
3. Click on the switch to enable

Once enabled, repeated failed logins from the same IP will be temporarily blocked based on your settings.

What’s next?

This module helps protect your site by limiting repeated failed login attempts and optionally notifying the site admin. It also supports custom login URLs and blocked usernames (when those modules are enabled).

Where it applies:

• Login pages (standard wp-login.php and supported custom login URLs)
• wp-admin access (for non-logged-in users)
• User registration form

1. Configure settings

1. Open the module’s “Settings” tab
2. Options:
   • Maximum Login Attempts: Number of failed attempts before a temporary block
   • Lockout Duration (minutes): Time an IP remains blocked after reaching the limit
   • Notify Admin: Email the admin when a user/IP is blocked
   • Block Usernames: If enabled, immediately blocks attempts using usernames configured in the Block Usernames module
3. Save settings

Tip:

• If you use a custom login path, the module will honor it automatically when the Custom Login URL module is active.

2. Review login attempts

1. Open the “Login Attempts” tab
2. View the table of attempts:
   • Username, IP, Date, Status, Remaining Time
3. Use table controls to search and sort. In Pro, additional actions may be available (e.g., Unblock).

Best Practices

• Start with 3–5 attempts and a 30-minute lockout, then adjust as needed
• Enable “Notify Admin” to monitor suspicious activity
• Combine with “Block Usernames” to immediately block known bad usernames (e.g., “admin”)
• Use with a custom login URL for further obfuscation

Troubleshooting

• Not blocking after failed attempts:
  • Ensure the module is enabled and settings are saved
  • Clear caches (page, CDN) and retry
• Admin still receiving brute-force attempts:
  • Lower the max attempts or increase lockout duration
  • Enable Block Usernames for common targets
• Custom login page not protected:
  • Verify the Custom Login URL module is active and configured
• Can’t access wp-admin while testing:
  • Wait until the lockout period ends or test from a different IP

Compatibility & Notes

• Applies to standard and supported custom login pages
• Blocks non-logged-in access to wp-admin for blocked IPs
• Cleans up expired attempts automatically
• Shows a count/message on the login screen indicating lockout status

Developer hooks

• Filters:
  • WPMazic/limit-login-attempts/table_columns — customize the “Login Attempts” table columns
  • WPMazic/limit-login-attempts/admin_email — change the admin email used for notifications
  • WPMazic/limit-login-attempts/site_name — change the site name used in notifications

This module is perfect for:

• Throttling brute-force login attempts
• Alerting admins to suspicious activity
• Pairing with custom login URLs and blocked usernames for layered security