=== SPP Login Attempt Limiter ===
Contributors: simpliplugin
Tags: security, login, brute force, limit login attempts, authentication
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Limit failed WordPress login attempts per IP address using transients to reduce brute-force attacks.

== Description ==

**SPP Login Attempt Limiter** helps protect your WordPress login page from brute-force attacks by tracking failed login attempts per IP address and temporarily locking out abusive clients.

This plugin is lightweight and uses the WordPress Transients API, so it works well on most hosting environments without creating custom database tables.

= Key features =

* Blocks login attempts early when an IP is locked out
* Tracks failed attempts per IP address
* Clears attempt data after a successful login
* Configurable lockout threshold, duration, and attempt window
* Shows remaining attempts on the login screen
* Clean uninstall removes plugin settings and related transients

= How it works =

1. When a user attempts to log in, the plugin checks whether the client IP is currently locked out.
2. If locked out, login is blocked and a clear error message is shown with the remaining lockout time.
3. If not locked out, WordPress authentication runs normally.
4. On failed login, the attempt count is incremented.
5. When the configured threshold is reached, a temporary lockout transient is created.
6. On successful login, failed attempt data for that IP is cleared.

= Links =

* [Plugin homepage on WordPress.org](https://wordpress.org/plugins/spp-login-attempt-limiter/)
* [Developer website](https://simpliplugin.com/)

== Installation ==

1. Upload the `spp-login-attempt-limiter` folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress Plugins screen.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Go to **Settings → Login Attempt Limiter** to configure lockout rules.

== Frequently Asked Questions ==

= Does this plugin use a custom database table? =

No. It uses WordPress transients for fast, lightweight tracking.

= Will legitimate users be affected? =

Only clients that exceed the configured number of failed login attempts within the attempt window are temporarily locked out.

= Can I change the lockout rules? =

Yes. Administrators can configure the failed attempt threshold, lockout duration, and attempt counting window from the settings page.

= Does the plugin support sites behind a reverse proxy? =

Yes. Developers can override the detected client IP using the `spp_lal_client_ip` filter when a trusted proxy is in use.

== Screenshots ==

1. Settings page under Settings → Login Attempt Limiter
2. Lockout message on the WordPress login screen

== Changelog ==

= 1.0.0 =
* Initial release
* Transient-based failed login tracking per IP
* Configurable lockout threshold, duration, and attempt window
* Admin settings page and clean uninstall support

== Upgrade Notice ==

= 1.0.0 =
Initial release of SPP Login Attempt Limiter.
