Limit Login Attempts documentation
Lock out an IP address after a set number of failed logins. Choose how long the lockout lasts, get an email when it happens, and detect visitors’ real IP addresses behind Cloudflare or a load balancer.
Overview
WordPress lets anyone try passwords on wp-login.php as many times as they like. Bots try thousands of combinations a day, which slows the server and eventually guesses weak passwords.
Behind a CDN, a badly configured limiter sees every visitor as the same IP address. Then it either locks out everyone or nobody.
Plan: Free + Pro options. The options marked Pro below need WP Extended Pro.
Setup
- Turn on Limit Login Attempts under Security & Privacy.
- Set the maximum attempts and the lockout duration in minutes.
- Switch on Notify Admin if you want an email for each block.
- If the site is behind Cloudflare or a proxy, choose the matching Client IP source.
Settings
| Setting | What it does | Plan |
|---|---|---|
| Maximum Login Attempts | Number of failed login attempts before blocking. | Free |
| Lockout Duration | How long to lockout accounts after reaching maximum attempts. | Free |
| Notify Admin | If enabled, an email will be sent to the admin when a user is blocked. | Free |
| Block Usernames | If enabled, usernames set in Block Usernames Module will be blocked immediately. | Free |
| Client IP source | Leave as the default unless this site sits behind a reverse proxy or CDN (e.g. Cloudflare). Only change this if the chosen header is set by your trusted edge — a header a visitor can send would let attackers spoof their IP and bypass or misdirect lockouts. | Free |
Questions and troubleshooting
Is Limit Login Attempts free?
Yes. Limits, lockouts, alerts and proxy settings are free. WP Extended Pro adds an action to unblock an account.
What are the default settings?
Three failed attempts trigger a 30-minute lockout. You can change both.
My site uses Cloudflare. What should I set?
Set Client IP source to CF-Connecting-IP. Only choose a header that your CDN or proxy sets, because visitors can fake the others.
I locked myself out. What now?
Wait for the lockout to end, or log in from a different network. With Pro you can unblock an account from the module settings.
It isn’t working as expected
Check the module is switched on and its settings are saved. If another plugin does the same job, deactivate one of them. Then clear any page cache and test again. Still stuck? Pro customers can contact support; free users can post on the WordPress.org forum.
Developers
Limit Login Attempts has 3 hooks. See the Limit Login Attempts developer reference.