About this plugin
Limit login attempts, stop brute force attacks, and protect your WordPress login with one of the most trusted WordPress security plugins, used on 2 million websites.
Limit Login Attempts Security adds brute force protection, two-factor authentication (2FA), a login firewall, bot protection, and IP blocking to the most targeted page on your site: the login page. It is lightweight, works automatically with the recommended settings, and won’t slow down your website.
Why WordPress Login Security Matters
By default, WordPress allows unlimited login attempts, so bots can guess usernames and passwords until one works. With AI-powered tools, attackers can run brute force attacks faster and more effectively than ever.
Most WordPress hacks and malware infections start with a compromised login. Limit Login Attempts Security closes that door by stopping brute force attacks, bot logins, credential stuffing, XML-RPC attacks, and WooCommerce login abuse before an attacker ever gets in. For complete website security, pair it with a malware scanner.
It is compatible with the popular ones.
Brute Force Protection & Limit Login Attempts
- Limit login attempts by IP address and by username
- Automatically lock out suspicious IPs and usernames
- Adjustable retry limits and lockout durations
- Protect wp-login.php and wp-admin from automated attacks
- Failed login protection with retry warnings for real users
Two-Factor Authentication (2FA / MFA)
Built-in two-factor authentication adds a second verification step to WordPress logins, so a stolen or guessed password alone isn’t enough. Secure login for administrators and users with no extra plugin required.
WordPress Firewall & Bot Protection
A lightweight login firewall that blocks malicious login requests, detects suspicious behavior, and reduces bot-based login attacks without the overhead of a full security suite.
XML-RPC Protection
php to try many passwords in a single request. XML-RPC protection applies the same login limits there, so this backdoor can’t bypass your brute force protection.
IP Blocking & Access Controls
- IP safelist and denylist (IP blocking), including IPv6 ranges
- Username safelist and denylist
- Custom trusted IP origin for Cloudflare and reverse proxy setups
Login Monitoring & Notifications
- Failed login attempt logs
- Lockout email notifications
- Denied attempt tracking
WooCommerce, Multisite & Plugin Compatibility
Protects WooCommerce login pages, custom login forms that use standard WordPress login hooks, and WordPress multisite networks. Compatible with Wordfence, Sucuri, Ultimate Member, MemberPress, WPS Hide Login, and Cloudflare.
Premium: Cloud Login Security (Free 14-Day Trial)
Upgrade to Limit Login Attempts Security Premium to move brute force protection to the cloud:
- Real-time malicious IP intelligence and a global denylist
- Country blocking for logins
- Offload failed login traffic from your server during attacks
- Enhanced throttling and lockout escalation
- Registration page protection and successful login tracking
- Lockout analytics with geolocation data
- Synchronized lockouts, safelists, and denylists across all your sites
- Cloud backups of IP data and CSV exports
- Unlock yourself from the cloud dashboard
- Priority support from security specialists
Lightweight WordPress Security
Unlike large security suites, Limit Login Attempts Security focuses on login security and brute force protection. That means faster performance, less server overhead, and easier setup, whether you run a blog, a WooCommerce store, a membership site, an agency, or an enterprise WordPress network.
Upgrading from the Original Limit Login Attempts Plugin?
- Remove the old Limit Login Attempts plugin
- Install Limit Login Attempts Security
- Your settings remain intact
Translations
Available in Spanish, French, German, Dutch, Turkish, Swedish, Russian, Romanian, Chinese (Traditional), Brazilian Portuguese, and more.