Shane

A while ago, arc90 decided that having to submit a form to find out if you’ve entered the right password was inefficient, so they set about finding a quick and secure way of telling you if the password you’ve entered is correct. They came up with <a href="http://lab.arc90.com/2009/07/hashmask.php" rel="nofollow ugc">Hashmask</a> which does that pretty well.
When you enter your password into the field, you’ll be shown a little graphic. Remember that graphic! That’s the visual representation of your password. For instance, if I enter my password I see a green shape, with two peaks at the beginning. If I type it in, and that’s not the graphic I see then I’ve typed it wrong and know to type it again (without wasting time submitting the page)!
It’s completely secure though. Even if someone sees what shape your password makes, there’s nothing that can do to convert that image back to a real word.

Hashmask for WordPress

Adding arc90's Hashmask to the login form; a secure way to quickly check you've typed the right password.

johanee

Limit the number of login attempts possible both through normal login as well as using auth cookies.
By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.
Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.
Features
<ul>
<li>Limit the number of retry attempts when logging in (for each IP). Fully customizable</li>
<li>Limit the number of attempts to log in using auth cookies in same way</li>
<li>Informs user about remaining retries or lockout time on login page</li>
<li>Optional logging, optional email notification</li>
<li>Handles server behind reverse proxy</li>
<li>It is possible to whitelist IPs using a filter. But you probably shouldn’t. 🙂</li>
</ul>
Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish
Plugin uses standard actions and filters only.

Limit Login Attempts

bad role

We had initial issues and tried again and it is working better.

Getting a lot better.


I absolutely hate bloated plugins, so I love this one. It's simple and works as expected. Guess it's wise to use a plugin such as this one, against brute force attacks.



Guido


Love this plugin

Limit rate of login attempts, including by way of cookies, for each IP. Fully customizable.

Hashmask for WordPress vs Limit Login Attempts