How to Limit Login Attempts in WordPress to Block Brute Force Attacks

By default, WordPress places no limit on how many times someone can attempt to log in. A visitor — or a bot — can try thousands of username and password combinations without being blocked. That’s exactly what brute force attacks rely on: automated tools cycling through credentials until something works. Most WordPress sites get targeted regularly, even small ones with no obvious value to an attacker, usually so the attacker can use the server for spam, redirect traffic, or install malware once they’re in.

Why This Is Worth Fixing First

WordPress is the most widely used CMS on the web, which makes it the most probed. Automated bots constantly test WordPress login pages using lists of common usernames and passwords — combinations like admin and password123 appear in enormous volumes of attempted logins across the web every day. Without a login limit, a determined bot can run tens of thousands of attempts against a site with no consequence until it guesses correctly. A lockout plugin removes that option: after a small number of failed attempts, the IP address is blocked for a set period, making the attack too slow to succeed. It also reduces unnecessary server load from repeated login requests hitting the database on every attempt.

Installing and Configuring It

Limit Login Attempts Reloaded is the most widely used plugin for this — free, actively maintained, and available directly from the WordPress plugin directory.

1. Install it. Go to Plugins → Add New, search for Limit Login Attempts Reloaded, install and activate.
2. Open the settings. Settings → Limit Login Attempts. No cloud account or advanced configuration is needed to get basic protection working.
3. Configure the lockout thresholds:
   • Allowed retries: the default is 4 failed attempts before a lockout. Going lower can occasionally catch a legitimate user who mistypes a password; 3–4 is the standard, practical range.
   • Lockout period: 20 minutes by default, which works well for most sites.
   • Lockouts until long lockout: after 4 short lockouts from the same IP by default, the ban escalates to 24 hours.
   Leave the trusted IP origin setting on its default unless the site sits behind a proxy or load balancer — changing it incorrectly can make all visitors appear to share one IP, locking out legitimate users along with attackers.
4. Enable email notifications. Set “Notify on lockout” to trigger after 3–5 lockouts, giving visibility into whether the site is being actively targeted without flooding an inbox on every individual attempt.
5. Save. The plugin now monitors all login attempts, including the standard login page, WooCommerce login forms, and the XML-RPC endpoint — no extra configuration needed for XML-RPC coverage, which bots frequently target as a secondary route in.

What the Lockout Actually Does to Attack Speed

It’s worth seeing the mechanism in numbers, not just as an abstract “it slows attackers down.” Credential-stuffing tools don’t try every possible password — that keyspace is astronomically large — they work through curated lists of real leaked passwords and common patterns, often millions of entries long, betting that some fraction of your visitors reuse a password that’s already been exposed in an unrelated breach. Without any limit, a single unthrottled bot can push several login requests per second at a WordPress site, meaning a list of a few million candidate passwords could be exhausted against one target account in well under an hour.

A lockout after 4 failed attempts and a 20-minute wait changes that arithmetic completely. The same attacker is now limited to 4 guesses per 20-minute window per IP address — roughly 288 guesses a day from a single IP, rather than potentially hundreds of thousands in the same period. To get back to their original speed, an attacker needs to spread the attempts across hundreds or thousands of different IP addresses (a botnet), which is a meaningfully higher bar than running a single script from one server, and it’s exactly the kind of large-scale, coordinated attack that a network-level firewall like Cloudflare exists to catch, rather than something a small site typically faces. For the vast majority of WordPress sites — which are opportunistic targets, not specifically chosen ones — the lockout alone is enough to make the attack not worth an attacker’s time.

Practical Tips

• Whitelist your own IP address under the IP Rules tab if working from a fixed IP — this prevents an accidental self-lockout during testing or after forgetting a password.
• Check the lockout log occasionally. Most sites see attempts concentrated in cloud hosting ranges and known proxy services, which gives a rough sense of where the attacks originate.
• Pair login limiting with other layers — a non-default admin username, a custom login URL, and two-factor authentication together give layered protection that no single measure provides alone. The website security guide covers the fuller picture.

What This Doesn’t Cover

Limiting login attempts addresses one attack vector — repeated guessing. It doesn’t scan for malware, protect file permissions, or block other types of intrusion, and it doesn’t stop an attacker who already has the correct password from a data breach elsewhere; for that layer, see how to set up two-factor authentication. Some all-in-one security plugins such as Wordfence already include login attempt limiting as part of a broader feature set — check whether it’s already active before installing a separate plugin if one of those is in use.

Common Mistakes

• Setting retries too low — 1 or 2 attempts creates a poor experience for real users who occasionally mistype credentials. 3–4 is the practical minimum before a lockout.
• Not whitelisting your own IP. A self-lockout during a migration or password reset means needing to access the database directly to clear the lockout record.
• Assuming this replaces a full security plugin, when it only addresses one vector among several.
• Changing the trusted IP origin setting incorrectly on standard shared hosting, where the default is already correct — if the server routes all traffic through a single proxy after a bad change, the first few login failures from any user could lock everyone out.

When to Go Further

Limit Login Attempts Reloaded covers the core need for most WordPress sites. For a high-traffic site, or centralised protection across multiple WordPress installations, a cloud-based firewall service such as Cloudflare can block brute force attempts at the network level before requests even reach WordPress — a more advanced setup, and not necessary for most sites starting out.

Install the plugin, set retries to 3 or 4, enable email notifications, and whitelist your own IP. It takes five minutes and removes one of the most common attack vectors from a WordPress site immediately.