Stop brute-force attacks on your login page
Lock out an IP address after a set number of failed logins. Choose how long the lockout lasts, get an email when it happens, and detect visitors’ real IP addresses behind Cloudflare or a load balancer.
Free on WordPress.org. Pro adds the extra options listed below.
- with extra Pro options
- Free
- settings to configure
- 5
- developer hooks
- 3
- updates since 2023
- 10
Why you need Limit Login Attempts
WordPress lets anyone try passwords on wp-login.php as many times as they like. Bots try thousands of combinations a day, which slows the server and eventually guesses weak passwords.
Behind a CDN, a badly configured limiter sees every visitor as the same IP address. Then it either locks out everyone or nobody.
What Limit Login Attempts does
Attempts and lockout time
Allow 3 failed attempts and lock out for 30 minutes by default, or set your own limits.
Admin alerts
Get an email when an IP address is blocked.
Works behind Cloudflare
Choose the trusted header for the visitor’s IP: CF-Connecting-IP, X-Forwarded-For, X-Real-IP or True-Client-IP.
Block usernames instantly
Pair it with Block Usernames so attempts on names like “admin” are blocked straight away. Pro adds an unblock action.
Set it up
In WordPress, open WP Extended and find Limit Login Attempts under Security & Privacy.
Full setup guide- 01 Turn on Limit Login Attempts under Security & Privacy.
- 02 Set the maximum attempts and the lockout duration in minutes.
- 03 Switch on Notify Admin if you want an email for each block.
- 04 If the site is behind Cloudflare or a proxy, choose the matching Client IP source.
Free and Pro options
What you can set in the free plugin, and what WP Extended Pro adds.
In the free plugin Free
- Maximum Login Attempts Number of failed login attempts before blocking.
- Lockout Duration How long to lockout accounts after reaching maximum attempts.
- Notify Admin If enabled, an email will be sent to the admin when a user is blocked.
- Block Usernames If enabled, usernames set in Block Usernames Module will be blocked immediately.
- Client IP source Leave as the default unless this site sits behind a reverse proxy or CDN (e.g. Cloudflare). Only change this if the chosen header is set by your trusted edge — a header a visitor can send would let attackers spoof their IP and bypass or misdirect lockouts.
Pro options unlock on any Pro plan, from $29 a year.
Where Limit Login Attempts helps
Any site with a public login
Cut the noise from password-guessing bots and the load they put on the server.
Sites behind Cloudflare
Lock out the attacker’s real IP instead of Cloudflare’s.
Client sites you manage
Get an alert when attacks start, before the client notices anything.
Limit Login Attempts vs Limit Login Attempts Reloaded
Limit Login Attempts Reloaded has 1M+ active installs on WordPress.org. If you only need this one job, that’s a fine choice. If the site also needs other modules on this list, it’s one less plugin to update.
- What Limit Login Attempts covers
- Attempt limits, lockout duration, admin alerts, proxy-aware IP detection and username blocking.
- When to choose the specialist plugin
- If you need two-factor authentication, a firewall or country blocking, use a full security plugin alongside it.
For developers
Limit Login Attempts has 3 hooks for changing its behaviour per project, without editing the plugin.
All Limit Login Attempts hooksadd_filter( 'wpextended/limit-login-attempts/admin_email', function ( $value ) {
// Return the value you want to use
return $value;
} );- limit-login-attempts/admin_email
- limit-login-attempts/site_name
- limit-login-attempts/table_columns
“Features I love the most: Disable Gutenberg Widgets, Duplicate Page and Posts, Limit Login Attempts, Post & Page Order, Maintenance Mode.”
Recent changes
The latest updates to Limit Login Attempts, from the WP Extended changelog.
Full changelog- v3.3.0 10 Sept 2026
- improved
New option to trust a proxy header when detecting a visitor’s IP address, for sites behind Cloudflare or a load balancer.
- fixed
A spoofed IP address could bypass the lockout, or lock out every visitor behind a proxy.
- fixed
Diagnostic REST routes were registered in production builds.
- fixed
Restored the unblock action, and fixed sorting and the status column.
- improved
- v3.1.0 22 Sept 2025
- new
Option to block usernames from Block Usernames module.
- new
Limit Login Attempts questions
Limit Login Attempts documentationYes. Limits, lockouts, alerts and proxy settings are free. WP Extended Pro adds an action to unblock an account.
Three failed attempts trigger a 30-minute lockout. You can change both.
Set Client IP source to CF-Connecting-IP. Only choose a header that your CDN or proxy sets, because visitors can fake the others.
Wait for the lockout to end, or log in from a different network. With Pro you can unblock an account from the module settings.
Get Limit Login Attempts free
Limit Login Attempts is in the free plugin on WordPress.org, alongside 34 other free modules you can switch on when you need them.
Pro from $29 a year · 14-day money-back guarantee