wordpress.org

By default WordPress allows unlimited login attempts through the login page but this will lock account after number of login attempts
Features
<ul>
<li>Limit the number of login attempts</li>
<li>Informs user about remaining attempts or block time on login page</li>
<li>Optional logging, optional email notification</li>
<li>Handles server behind reverse proxy</li>
<li>It is possible to whitelist IPs using a filter.</li>
</ul>
Plugin uses standard actions and filters only.

Login Restrict

For security, it will lock account after number of login attempts.

andersvinther2

WP Login Security 2 provides enhanced security by requiring users to whitelist their IP address. 
If the IP address is not recognized, the plugin will send an email to the user with a link that contains a one-time key. Optionally the blog administrator can also be notified.
If a user logs in from a known IP address no further action is required.
What does this Plugin do?
<ol>
<li>Each time a user logs in, the plugin will compare their existing IP address to the last seen IP address.</li>
<li>If the IP does not match or no IP addresses have been whitelisted, an email will be sent to the users registered email address.</li>
<li>The user must login to their email and click the included link, which contains the one-time password.</li>
<li>The plugin can be configured to also send an email to the blog administrator as well as the user. </li>
</ol>
Updates from the original plugin
This plugin is based on the original <a href="https://wordpress.org/extend/plugins/wp-login-security/" rel="ugc">WP Login Security</a> plugin developed by joshuascott94.
Since the original plugin is not supported any longer we took over and made a few updates:
<ol>
<li>Fixed: Incorrect number of parameters were passed to mt_rand().</li>
<li>Recoded: The plugin notifications on the login screen only worked when Output Buffering was turned on in php.ini.</li>
<li>Added buttons to clear whitelist and outstanding activation codes.</li>
<li>Added code to clean up data on uninstallation.</li>
</ol>

WP Login Security 2

Whitelist User IP addresses. If a user logs in from an unknown IP the plugin sends an email to the user and optionally the admin with a one-time key.

Login Restrict vs WP Login Security 2