Theme Egg

Limit the number of login attempts possible both through normal login as well as using auth cookies.
By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.
Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.
Features 
* Limit the number of retry attempts when logging in (for each IP). Fully customizable 
* Limit the number of attempts to log in using auth cookies in same way 
* Informs user about remaining retries or lockout time on login page 
* Optional logging, optional email notification 
* Handles server behind reverse proxy 
* It is possible to whitelist IPs using a filter. But you probably shouldn’t. 🙂

Limit Login Attempts

Simon Kraft

Thomas Günther

protect.one

Out of the box, WordPress allows unlimited attempts to log in. This opens up opportunities for attackers to crack passwords simply by trying over and over again. This kind of attack is called brute-force, and Protect Login mitigates this by slowing down the login after a series of subsequent failed attempts.
But we did not stop there. We’re also working on ways to improve the security of your WordPress passwords. Currently, we do this by allowing you to enforce a password policy to make sure your users don’t use weak passwords for their accounts.

Protect Login

Add an additional layer of protection to your WordPress login and make sure bad actors have a hard time guessing your user's login credentials.

Limit Login Attempts vs Protect Login