Brute-Force Defense
How to Limit Login Attempts in WordPress and Stop the Guessing
Without a cap on failed logins, bots can try thousands of password combinations against wp-login.php with nothing slowing them down. Setting an attempt limit shuts that down in minutes.
24/7
Support if login traffic looks abnormal
NVMe
Fast storage even under bot traffic
Daily
Backups in case a lockout is misconfigured
30-Day
Money-back guarantee
In short
Limiting login attempts in WordPress means installing a plugin, or enabling a host-level setting, that counts failed logins per user or IP address and temporarily locks out that source after a set number of tries, typically three to five. This stops brute-force scripts from cycling through thousands of password guesses and reduces the server load those attempts create, without requiring visitors to do anything differently when they log in correctly.
Out of the box, WordPress will accept login attempts with no built-in counter or cooldown, which is exactly what automated brute-force scripts rely on. A bot pointed at wp-login.php can run through common password lists around the clock, and every one of those requests still consumes server resources even when it fails.
This is a narrower fix than two-factor authentication: 2FA stops a correct password from being enough on its own, while attempt limiting stops the guessing process itself by cutting off a source after a handful of failures. Used together they cover both the guessing stage and the credential stage, but attempt limiting alone is often what a site needs first if login page traffic is spiking.
Why WordPress Has No Login Attempt Limit Out of the Box
WordPress core was built to be flexible for a huge range of use cases, and login throttling was left to plugins rather than baked into the base install, similar to how caching and SEO are handled by add-ons rather than core features. That means a fresh install has no cap at all on failed attempts.
For a low-traffic site this rarely gets noticed until a bot discovers the login page, at which point failed attempts can climb into the thousands within a day, showing up as unusual CPU load or a spike in log entries for wp-login.php long before any password is actually guessed.
Setting a Login Attempt Limit With a Plugin
A login-limiting plugin tracks failed attempts per username and IP address, then locks that combination out for a set cooldown period, commonly starting at 20 minutes and increasing for repeat offenders. Most plugins let the threshold, typically three to five failed tries, be adjusted from the dashboard.
Configure the lockout message to avoid confirming whether a username exists, since a message like 'incorrect username or password' gives an attacker less to work with than one that specifies which field was wrong. Also whitelist your own office or home IP if it's static, to avoid locking yourself out during normal typos.
Locking Out Repeat Offenders by IP
Beyond a single cooldown, most attempt-limiting tools support longer bans for IP addresses that keep coming back after their first lockout expires, escalating from minutes to hours or blocking addresses that show a clear automated pattern.
Reviewing the plugin's lockout log periodically is worth the few minutes it takes, since a large volume of attempts from a narrow range of IP addresses can indicate a targeted attack rather than generic scanning, and may warrant a broader block at the server or firewall level.
Combining Attempt Limits With Server-Level Protection
Plugin-based limiting works at the WordPress application layer, but every blocked request still reaches the server first. Pairing it with server-level protection, such as a firewall that can rate-limit requests to wp-login.php before they hit PHP at all, reduces load further on a site getting heavy bot traffic.
A hosting environment with NVMe storage and LiteSpeed keeps the site responsive even while under this kind of scanning, and 24/7 human support is useful for confirming whether a spike in login traffic is routine bot noise or something that needs a firewall rule added.
Hosting Built to Stay Fast Under Bot Traffic
A wave of failed login attempts is still server load, even when every single one is rejected instantly. Pure NVMe SSD storage and LiteSpeed keep response times steady while a login-limiting plugin does its job in the background.
Daily backups also mean that if a lockout setting is misconfigured and blocks legitimate access, a quick restore or a support ticket resolves it without any risk of losing content.
- NVMe SSD storage that stays responsive under bot scanning
- LiteSpeed for consistently fast page loads
- Daily backups in case a lockout setting needs undoing
- 24/7 human support to review unusual login activity
Why Hosting Cheap
What you get
NVMe SSD + LiteSpeed
Keeps the site fast even while absorbing repeated failed login requests from bots.
24/7 Human Support
Get a second opinion on whether a login traffic spike is routine or worth a firewall rule.
Daily Backups
A misconfigured lockout is a quick restore away from being fixed, not a lost login.
Free Auto-Renewing SSL
Login credentials stay encrypted in transit on every plan by default.
cPanel-Style Panel
Install and configure a login-limiting plugin in a few clicks through the one-click installer.
30-Day Money-Back Guarantee
Try a hosting environment tuned to handle bot traffic without commitment.
How It Works
Get set up in a few steps
Install a login-limiting plugin
Add a plugin that tracks failed attempts per username and IP address.
Set the threshold and cooldown
Cap failed attempts at three to five tries with an escalating lockout period.
Review the lockout log regularly
Check for repeat offenders or patterns that suggest a targeted attack, not just generic scanning.
Included
Everything you need, on every plan
- Install a plugin that limits failed login attempts
- Set a threshold of three to five failed tries
- Use an escalating cooldown for repeat offenders
- Avoid lockout messages that confirm valid usernames
- Whitelist your own static IP to prevent self-lockout
- Review the lockout log for unusual patterns
- Pair attempt limits with a broader firewall where possible
FAQ
Frequently asked questions
How many failed login attempts should trigger a lockout?
Three to five failed attempts is a common starting point, balancing security against the chance a real user simply mistypes their password a couple of times. The cooldown period can then be extended for anyone who keeps hitting the limit.
Does limiting login attempts replace the need for two-factor authentication?
No, they solve different problems. Attempt limiting slows down or stops the guessing process itself, while two-factor authentication makes a correctly guessed or leaked password insufficient on its own. Using both closes more of the login page than either alone.
Can limiting login attempts lock out real users by mistake?
It can, if a shared office IP address has several people mistyping passwords around the same time, or if a static home IP isn't whitelisted. Setting a reasonable threshold and reviewing the lockout log catches this quickly if it happens.
Will this slow down my server if bots keep trying to log in?
A login-limiting plugin still has to process each request to know it's blocked, so heavy bot traffic is best paired with fast storage and a host that can absorb the load, plus a server-level firewall rule for the most persistent sources.
Is there a way to hide the login page instead of just limiting attempts?
Yes, moving the login URL away from the default wp-login.php address is a separate, complementary step that reduces how much bot traffic reaches the login form in the first place, on top of attempt limiting.
How do I know if my site is currently being targeted?
Check for a large number of entries for wp-login.php in server logs, an unusual spike in CPU usage without a matching rise in real visitors, or repeated lockout notifications from a security plugin over a short period.
Stop Brute-Force Bots Before They Slow You Down
Host on NVMe storage with 24/7 support ready to help if login traffic looks abnormal.
Get Started