How to Limit Login Attempts in WordPress

By default, WordPress lets anyone try to log in as many times as they want. A bot can submit thousands of username and password combinations against your login page, and WordPress will check every one of them. Limiting login attempts closes that door: after a set number of failed tries, the visitor’s IP address is locked out for a period of time, and automated attacks stall.

In this guide, you’ll learn why brute-force attacks target WordPress, how to limit login attempts with a plugin, which settings to choose, and which extra protections make your login page much harder to attack.

What Is a Brute-Force Attack?

A brute-force attack is an automated attempt to guess login credentials. Bots work through lists of common passwords, or passwords leaked from other websites, until one works. Attackers don’t need to target your site specifically. They scan the web for any WordPress login page and attack them all.

WordPress is an obvious target because it powers a large share of the web, and its login page is at the same address on almost every site: /wp-login.php. The OWASP description of brute-force attacks explains the technique in more detail.

Why This Matters Even if Your Password Is Strong

A strong, unique password makes a successful guess very unlikely. But unlimited attempts still cause problems:

Server load: every login attempt runs PHP and queries your database. Thousands of attempts can slow your site for real visitors, especially on shared hosting.
Weak accounts elsewhere on the site: your password may be strong, but an old editor or client account might use “Summer2024.”
Reused passwords: if a team member’s password appears in a data breach, bots can try it on your site within days.

Many site owners don’t realize their login page is being hammered until something breaks. Watch for:

Sudden slowdowns or high CPU warnings from your host.
Many POST requests to wp-login.php or xmlrpc.php in your server access logs.
Password reset emails you didn’t request.
Login attempts for usernames like “admin,” “administrator,” or your domain name.

Managing security across many client sites, or recovering from an attack? Simpli Plugin’s team builds custom WordPress security tooling and can help harden sites that need more than a single plugin.

Talk to Our Developers →

WordPress has no built-in setting for this, so you’ll need a plugin, a firewall at your host or CDN, or both. For most sites, a dedicated plugin is the simplest starting point.

Large security suites include login limiting alongside malware scanning, firewalls, and dozens of other features. If you only need to stop brute-force attempts, a focused plugin is lighter and easier to configure. A good login limiter should:

Track failed attempts by IP address.
Lock out an IP temporarily once a threshold is reached.
Show a clear message to locked-out users.
Avoid revealing whether the username or the password was wrong.

Login Attempt Limiter from Simpli Plugin is a free plugin built for this. It monitors the login page, tracks failed authentication attempts per IP address, and enforces temporary lockouts when the limit is reached, which stops automated guessing and the server load that comes with it.

Step 2: Install and Activate the Plugin

Download the plugin ZIP from its product page.
Go to Plugins → Add New Plugin → Upload Plugin.
Upload the file, click Install Now, then Activate Plugin.

Step 3: Choose Sensible Lockout Settings

The goal is to stop bots without locking out real people who mistype a password. These values work well for most sites:

Setting	Recommended starting value	Why
Allowed failed attempts	3–5	Enough for honest typos, far too few for a bot
First lockout duration	15–30 minutes	Slows attacks to a crawl without stranding real users for long
Repeat lockouts	Longer, e.g. 24 hours	Persistent attackers get blocked for much longer

Five attempts every 30 minutes means a bot can try at most 240 passwords a day from one IP address, instead of tens of thousands.

Step 4: Test Without Locking Yourself Out

Open a private browser window, or use your phone on mobile data so you’re on a different IP address. Enter a wrong password until the lockout triggers, then confirm the message appears. Your main browser session stays logged in, so you can adjust settings if something isn’t right.

Limiting attempts is one layer. Combine it with a few others and brute-force attacks become close to pointless.

Use Strong, Unique Passwords for Every Account

Require a password manager for your team and review every user account. Remove old accounts, and downgrade users who don’t need administrator access.

Most bots go straight to /wp-login.php and /wp-admin. Moving the login page to a custom address filters out a large share of automated traffic before it ever reaches your login form. Simpli’s free Custom Login URL Obfuscator does this. Treat it as noise reduction rather than real security, since a determined attacker can still find the page, and keep the new URL somewhere safe.

Disable XML-RPC if You Don’t Use It

The xmlrpc.php endpoint is an older remote-access interface. Its system.multicall method lets an attacker test many passwords in a single request, which can slip past simple attempt counters. If you don’t use the WordPress mobile app, Jetpack, or another tool that depends on it, disable it. Simpli’s XML-RPC & REST Disabler handles this. Be careful with REST API restrictions on headless sites, since the frontend relies on the API.

Add Two-Factor Authentication

Two-factor authentication (2FA) requires a second code from an authenticator app in addition to the password. Even a correct password guess isn’t enough to get in. Enable it at least for every administrator account.

Block Attacks Before They Reach WordPress

A web application firewall at your host or CDN, such as Cloudflare, can rate-limit or challenge requests to your login page before PHP even runs. This is the most efficient protection during a large attack.

Common Problems and How to Fix Them

You Locked Yourself Out

Wait for the lockout to expire, or connect from a different network, such as mobile data. If you need immediate access, rename the plugin’s folder in wp-content/plugins using your host’s File Manager or SFTP. WordPress will deactivate it, and you can log in, rename the folder back, and reactivate it.

Everyone Gets Locked Out at Once

If your site sits behind a proxy or CDN, WordPress may see the proxy’s IP address instead of each visitor’s real IP. One person’s failed attempts then lock out everyone. Check that your server passes the real visitor IP through headers such as CF-Connecting-IP or X-Forwarded-For, and that the plugin reads it correctly.

Attacks Continue After Installing the Plugin

Bots rotate through many IP addresses, so you’ll still see attempts. What matters is that each IP is stopped quickly. If server load stays high, add firewall rate limiting at the host or CDN level and disable XML-RPC.

Frequently Asked Questions

No. WordPress allows unlimited login attempts out of the box. You need a plugin, a firewall, or custom code to add limits.

Three to five failed attempts before a lockout is a good balance for most sites. Sites with many customer logins, such as membership sites or WooCommerce stores, may prefer five so customers aren’t locked out after a couple of typos.

It can, if customers log in through the same WordPress authentication. Use a slightly higher attempt limit and a short first lockout so genuine customers aren’t frustrated.

It’s an important layer, not a complete security plan. Combine it with strong passwords, two-factor authentication, regular updates, backups, and a firewall.

Close the Door on Brute-Force Attacks

Unlimited login attempts are an open invitation to bots. Adding a lockout after a handful of failures takes a few minutes and cuts attack attempts from thousands a day to a few hundred per IP. Pair it with a custom login URL, disabled XML-RPC, and 2FA for strong protection.

Download Login Attempt Limiter for free, and browse the rest of the Simpli Plugin library. If you need security features built around your own setup, such as custom lockout rules, alerts, or a hardening plugin for client sites, our team can build it.

Request a Custom Plugin →

What Is a Brute-Force Attack?

Why This Matters Even if Your Password Is Strong

Signs Your WordPress Login Is Under Attack