Limit Login Attempts in WordPress
WordPress does not limit failed logins on its own. Install Limit Login Attempts Reloaded, keep four allowed retries and a 20-minute lockout, and save. Then enter a wrong password five times in a private window: a lockout notice in place of the login form confirms the limit works. Pair it with two-factor authentication.
For WordPress owners and agencies stopping password-guessing bots on wp-login.php without locking out their own editors or customers.
knowledge
- Read time
- 5 min
- Sections
- 6
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
Does WordPress limit login attempts by default?
No: WordPress core accepts unlimited password guesses on /wp-login.php, with no retry cap and no lockout, so a script can keep trying usernames and passwords for as long as it likes. Limiting attempts has to be added with a plugin or a server rule.
These requests are almost always automated. A correct guess signs the attacker in; every wrong guess still runs PHP and a database query, which slows the site and, on shared hosting, adds load to the server. A retry limit cuts each address off quickly. It complements, rather than replaces, a strong unique password and two-factor authentication.
Which method should you use to limit WordPress logins?
Use exactly one limiter: Limit Login Attempts Reloaded if you have no security plugin, or the lockout built into Wordfence or Solid Security if you already run one. Two lockout systems fight each other and can keep a real user blocked after the first timer ends.
| Method | What it does | Best for |
|---|---|---|
| Limit Login Attempts Reloaded | Counts failed logins per IP and locks that address for a set time | Most sites with no security plugin |
| Wordfence or Solid Security lockout | The same counting, inside a wider security suite | Sites already running that plugin |
.htaccess IP allowlist | Only named IPs can open the login page; others get 403 | Single-admin sites with a fixed office IP |
| fail2ban on a VPS | Bans an IP in the firewall after repeated failures in the logs | Servers you administer |
How do you set up Limit Login Attempts Reloaded?
Install and activate the plugin, confirm Allowed retries is 4 and Minutes lockout is 20, save, then test from a private window until a lockout notice replaces the login form. Four retries and 20 minutes are the plugin's starting values and suit most sites.
- Go to Plugins → Add New, search "Limit Login Attempts Reloaded", click Install Now and Activate.
- Open Limit Login Attempts → Settings. Check Allowed retries (4) and Minutes lockout (20), and save.
- Keep this browser signed in. In a private window, open
/wp-login.phpand enter a wrong password five times. - The form should be replaced by a lockout notice. In the signed-in window, the plugin's log should show your test IP and username.
If the fifth attempt still shows the form, the setting did not save or another plugin is handling logins. If the site sits behind Cloudflare or another proxy, check the plugin's trusted IP origin setting; otherwise it may see the proxy's address instead of the visitor's and lock out many users at once.
What retry limit and lockout time should you choose?
Four failed attempts and a 20-minute lockout are enough for a mistyped password and far too few for a script that needs thousands of guesses. Adjust only if real users are being locked out.
| Site type | Retries | Lockout | Why |
|---|---|---|---|
| Single-admin blog or brochure | 3–4 | 60 minutes | Only you log in |
| Business site with a few editors | 4 | 20 minutes | Default balance |
| WooCommerce or membership site | 5–6 | 20 minutes | Customers share office or mobile IPs |
Avoid very high caps such as 50, which are close to no cap. Repeat offenders can be locked out for longer: the plugin can escalate the lockout after several lockouts in a row. Note that this setting counts failed passwords; it does not limit how many devices a user may stay signed in on.
How do you get back in if you lock yourself out?
Wait for the lockout to expire, or disable the plugin by renaming its folder so the login form returns. Do not borrow another user's account to get in.
- In the hosting file manager or over SFTP, open
wp-content/plugins. - Rename
limit-login-attempts-reloadedtolimit-login-attempts-reloaded-off. With SSH,wp plugin deactivate limit-login-attempts-reloadeddoes the same. - Reload
/wp-login.phpand sign in. - Rename the folder back (or reactivate the plugin), then clear your IP from the log or add it to the plugin's allow list.
A lockout is not a forgotten password. Use "Lost your password?" only once the form is visible again, or follow changing the WordPress admin password. WebJi® customers who are unsure about the file manager can email support@webji.services, answered 24/7 in Hindi and English with an average first reply under 60 minutes.
Can you protect wp-login.php without a plugin?
Yes, with an IP allowlist in .htaccess: only the addresses you list can open wp-login.php, and everyone else gets 403 Forbidden. It is not a retry counter, and it locks you out too if your IP changes.
# In the site's root .htaccess, above the "# BEGIN WordPress" block
<Files "wp-login.php">
Require ip 203.0.113.10
</Files>Replace 203.0.113.10 with your own public IP (add more Require ip lines for more addresses). Test from a phone on mobile data: it should get 403 while your office loads the form. If you lose access, delete the block in the file manager. This syntax is for Apache 2.4 and LiteSpeed; Nginx needs an allow/deny rule in the server config. The .htaccess guide explains where the file lives.
What else attackers use besides wp-login.php
Password guesses also arrive through xmlrpc.php, which can test many passwords in a single request, so a login limit should be paired with XML-RPC protection. Changing the login URL reduces noise but does not stop someone who finds the new address.
- XML-RPC: block or disable it unless the WordPress mobile app or Jetpack needs it; see disabling XML-RPC.
- Login URL: changing the login URL hides the default path from bots; keep the retry limit anyway.
- Usernames: avoid "admin" and do not reuse your public author name as the login.
- Two-factor authentication: the strongest single step for admin accounts.
The full hardening list is in the WordPress security checklist. If a site has already been broken into, WebJi® offers WordPress security services for cleanup and hardening.
Frequently asked questions
How do I see who has been trying to log in?
Open the Limit Login Attempts log in wp-admin. Each row shows the IP address, the username tried and the time. Many different usernames from rotating IPs is normal bot traffic; repeated attempts on your real username deserve a password change and two-factor authentication.
Will a login limit stop attackers using many IP addresses?
Partly. Each IP is cut off after a few tries, which slows a distributed attack sharply but cannot block it completely. A strong unique password and two-factor authentication make the remaining guesses useless.
Can a login limit lock out my WooCommerce customers?
Yes, if several customers share one IP, such as an office network, and keep mistyping passwords. Use five or six retries and a 20-minute lockout on shops, and make sure the plugin reads the real visitor IP if you use a CDN.
Does limiting login attempts slow down WordPress?
No, it usually reduces load. Each blocked guess is rejected early instead of running a full password check, so a site under a brute-force attack often becomes faster once a limit is in place.
Reviewed by the WebJi® team, Jaipur, 15 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.