wordpress.org

By default WordPress allows unlimited login attempts through the login page but this will lock account after number of login attempts
Features
<ul>
<li>Limit the number of login attempts</li>
<li>Informs user about remaining attempts or block time on login page</li>
<li>Optional logging, optional email notification</li>
<li>Handles server behind reverse proxy</li>
<li>It is possible to whitelist IPs using a filter.</li>
</ul>
Plugin uses standard actions and filters only.

Login Restrict

For security, it will lock account after number of login attempts.

Login Restrict vs Two Factor