chrisguitarguy

Simple login lock down is a way to protect your WordPress blog from brute force login attacks.
How it works: 
1. An attacker attempts to login and fails 
2. Simple Login Lockdown record that failed login 
3. After a certain number of failed attemps (defaults to five), further attemps to access the wp-login.php page are blocked for a time (defaults to one hour).
If you happen to forget your password and make a failed login attemp yourself, the plugin will clear out the lockdown count data on successful login.
Note: This uses $_SERVER[‘REMOTE_ADDR’] directly. If you’re behind a proxy (load balancer, etc), it’s not going to work as expected. Eg. Several folks could be attempting logins at once, and all fail. As such, the plugin would pick up on all those requests coming from the same IP — the load balancer — and lock the login down. No good. If you’re using a load balancer or in some other situation where you’re behind a proxy, use this as an example and write your own. Or filter the IP as your desire using <code>cd_sll_pre_ip</code>.
<h3>Hooks</h3>
<pre><code>simple_login_lockdown_ip -- Alter the requesting IP address. Might be useful if you site is behind a proxy or load balancer.

simple_login_lockdown_allow_ip -- Allows you to "whitelist" an IP address. It first when a log attempt fails before the attempt count is incremented. Return true and no count will be taken for the IP.

simple_login_lockdown_should_die -- A filter that allows you to prevent the login page from `die`ing if a the requesting IP is temporarily blacklisted or the login limit has been reached.

simple_login_lockdown_count_reached -- Fires when the requesting IP has reached its count and will be added to the blacklist for your time limit.

simple_login_lockdown_attempt -- Fires when a login attempt is made but the requestin IP is blocked to to excessive requests.

simple_login_lockdown_response -- Change the HTTP response code of that gets sent when a blacklisted IP attempts to login.

simple_login_lockdown_time_values -- Allows you to alter values in the login lockdown time dropdown in the admin area.
</code></pre>

Simple Login Lockdown

Simple Login Lockdown prevents brute force login attacks/attempts on your WordPress installation.

johanee

Limit the number of login attempts possible both through normal login as well as using auth cookies.
By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.
Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.
Features
<ul>
<li>Limit the number of retry attempts when logging in (for each IP). Fully customizable</li>
<li>Limit the number of attempts to log in using auth cookies in same way</li>
<li>Informs user about remaining retries or lockout time on login page</li>
<li>Optional logging, optional email notification</li>
<li>Handles server behind reverse proxy</li>
<li>It is possible to whitelist IPs using a filter. But you probably shouldn’t. 🙂</li>
</ul>
Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish
Plugin uses standard actions and filters only.

Limit Login Attempts

bad role

We had initial issues and tried again and it is working better.

Getting a lot better.


I absolutely hate bloated plugins, so I love this one. It's simple and works as expected. Guess it's wise to use a plugin such as this one, against brute force attacks.



Guido


Love this plugin

Limit rate of login attempts, including by way of cookies, for each IP. Fully customizable.

Simple Login Lockdown vs Limit Login Attempts