Theme Egg

Limit the number of login attempts possible both through normal login as well as using auth cookies.
By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.
Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.
Features 
* Limit the number of retry attempts when logging in (for each IP). Fully customizable 
* Limit the number of attempts to log in using auth cookies in same way 
* Informs user about remaining retries or lockout time on login page 
* Optional logging, optional email notification 
* Handles server behind reverse proxy 
* It is possible to whitelist IPs using a filter. But you probably shouldn’t. 🙂

Limit Login Attempts

andersvinther2

WP Login Security 2 provides enhanced security by requiring users to whitelist their IP address. 
If the IP address is not recognized, the plugin will send an email to the user with a link that contains a one-time key. Optionally the blog administrator can also be notified.
If a user logs in from a known IP address no further action is required.
What does this Plugin do?
<ol>
<li>Each time a user logs in, the plugin will compare their existing IP address to the last seen IP address.</li>
<li>If the IP does not match or no IP addresses have been whitelisted, an email will be sent to the users registered email address.</li>
<li>The user must login to their email and click the included link, which contains the one-time password.</li>
<li>The plugin can be configured to also send an email to the blog administrator as well as the user. </li>
</ol>
Updates from the original plugin
This plugin is based on the original <a href="https://wordpress.org/extend/plugins/wp-login-security/" rel="ugc">WP Login Security</a> plugin developed by joshuascott94.
Since the original plugin is not supported any longer we took over and made a few updates:
<ol>
<li>Fixed: Incorrect number of parameters were passed to mt_rand().</li>
<li>Recoded: The plugin notifications on the login screen only worked when Output Buffering was turned on in php.ini.</li>
<li>Added buttons to clear whitelist and outstanding activation codes.</li>
<li>Added code to clean up data on uninstallation.</li>
</ol>

WP Login Security 2

Whitelist User IP addresses. If a user logs in from an unknown IP the plugin sends an email to the user and optionally the admin with a one-time key.

Limit Login Attempts vs WP Login Security 2