Theme Egg

Limit the number of login attempts possible both through normal login as well as using auth cookies.
By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.
Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.
Features 
* Limit the number of retry attempts when logging in (for each IP). Fully customizable 
* Limit the number of attempts to log in using auth cookies in same way 
* Informs user about remaining retries or lockout time on login page 
* Optional logging, optional email notification 
* Handles server behind reverse proxy 
* It is possible to whitelist IPs using a filter. But you probably shouldn’t. 🙂

Limit Login Attempts

Henrik Schack

This is a plugin for WordPress that provides multifactor authentication with one-time passwords using the <a href="http://www.yubico.com/" rel="nofollow ugc">Yubikey USB token</a>. 
The plugin uses the Yubico Web service API in the authentication process. 
The one-time password requirement can be enabled on a per user basis.

yubikey-plugin

Thanks for an amazing plugin. Hopefully the maintainer is looking and will update things to show they are tested as working with WP 5.4, since it does.

Love that I can use my YubiKey on WP

Enhanced Login Security for Your Wordpress blog.

Limit Login Attempts vs yubikey-plugin