chrisguitarguy

Simple login lock down is a way to protect your WordPress blog from brute force login attacks.
How it works: 
1. An attacker attempts to login and fails 
2. Simple Login Lockdown record that failed login 
3. After a certain number of failed attemps (defaults to five), further attemps to access the wp-login.php page are blocked for a time (defaults to one hour).
If you happen to forget your password and make a failed login attemp yourself, the plugin will clear out the lockdown count data on successful login.
Note: This uses $_SERVER[‘REMOTE_ADDR’] directly. If you’re behind a proxy (load balancer, etc), it’s not going to work as expected. Eg. Several folks could be attempting logins at once, and all fail. As such, the plugin would pick up on all those requests coming from the same IP — the load balancer — and lock the login down. No good. If you’re using a load balancer or in some other situation where you’re behind a proxy, use this as an example and write your own. Or filter the IP as your desire using <code>cd_sll_pre_ip</code>.
<h3>Hooks</h3>
<pre><code>simple_login_lockdown_ip -- Alter the requesting IP address. Might be useful if you site is behind a proxy or load balancer.

simple_login_lockdown_allow_ip -- Allows you to "whitelist" an IP address. It first when a log attempt fails before the attempt count is incremented. Return true and no count will be taken for the IP.

simple_login_lockdown_should_die -- A filter that allows you to prevent the login page from `die`ing if a the requesting IP is temporarily blacklisted or the login limit has been reached.

simple_login_lockdown_count_reached -- Fires when the requesting IP has reached its count and will be added to the blacklist for your time limit.

simple_login_lockdown_attempt -- Fires when a login attempt is made but the requestin IP is blocked to to excessive requests.

simple_login_lockdown_response -- Change the HTTP response code of that gets sent when a blacklisted IP attempts to login.

simple_login_lockdown_time_values -- Allows you to alter values in the login lockdown time dropdown in the admin area.
</code></pre>

Simple Login Lockdown

Simple Login Lockdown prevents brute force login attacks/attempts on your WordPress installation.

NicolasKulka

WPServeur

wpformation

<h4>Français</h4>
Limitez le nombre de tentatives de connexion possibles via la page de connexion et en utilisant les cookies auth. 
WordPress par défaut permet des tentatives de connexion illimitées soit via la page de connexion ou en envoyant des cookies spéciaux. Cela permet aux mots de passe (ou hashs) d’être craqués via la force brute relativement facilement. 
WPS Limit login limite les tentatives de connexion et bloque l’envoi d’autres tentatives à une adresse Internet après l’atteinte d’une limite spécifiée, ce qui rend une attaque par force brute difficile, voire impossible.
Caractéristiques:
<ul>
<li>Limiter le nombre de nouvelles tentatives lors de la connexion (pour chaque IP). Ceci est entièrement personnalisable.</li>
<li>Limitez le nombre de tentatives de connexion en utilisant des cookies d’autorisation de la même manière.</li>
<li>Informe l’utilisateur sur les tentatives restantes ou le temps de verrouillage sur la page de connexion.</li>
<li>Journalisation et notification par courriel facultative.</li>
<li>Gère le serveur derrière le proxy inverse (reverse proxy).</li>
<li>Il est possible de mettre en liste blanche / liste noire les adresses IP.</li>
<li>Compatibilité avec le pare-feu du site Web Sucuri.</li>
<li>Protection de passerelle XMLRPC.</li>
<li>Woocommerce protection de la page de connexion.</li>
<li>Compatibilité multi-sites avec des paramètres MU supplémentaires.</li>
</ul>
Pour en savoir plus lisez l’article suivant : <a href="https://wpformation.com/wps-limit-login/" rel="nofollow ugc">https://wpformation.com/wps-limit-login</a>
Ce plugin vous est gentiment proposé par <a href="https://www.wpserveur.net/?refwps=14&campaign=wpslimitlogin" rel="nofollow ugc">WPServeur</a> l’hébergeur spécialisé WordPress.
Découvrez également nos autres extensions gratuites : 
– <a href="https://fr.wordpress.org/plugins/wps-hide-login/" rel="nofollow ugc">WPS Hide Login</a> pour changer votre URL de connexion en ce que vous voulez. 
– <a href="https://fr.wordpress.org/plugins/wps-bidouille/" rel="nofollow ugc">WPS Bidouille</a> pour optimiser votre WordPress et faire le plein d’infos. 
– <a href="https://fr.wordpress.org/plugins/wps-cleaner/" rel="nofollow ugc">WPS Cleaner</a> pour nettoyer votre site WordPress.
Ce plugin est seulement maintenu, ce qui signifie que nous ne garantissons pas un support gratuit. Envisagez de signaler un problème et soyez patient.
<h4>English</h4>
Limit the number of login attempts that possible both through the normal login as well as using the auth cookies. 
WordPress by default allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be cracked via brute-force relatively easily. 
WPS Limit login blocks an Internet address from making further attempts after a specified limit on retries has been reached, making a brute-force attack difficult or impossible.
Features:
<ul>
<li>Limit the number of retry attempts when logging in (per each IP). This is fully customizable.</li>
<li>Limit the number of attempts to log in using authorization cookies in the same way.</li>
<li>Informs the user about the remaining retries or lockout time on the login page.</li>
<li>Optional logging and optional email notification.</li>
<li>Handles server behind the reverse proxy.</li>
<li>It is possible to whitelist/blacklist IPs.</li>
<li>Sucuri Website Firewall compatibility.</li>
<li>XMLRPC gateway protection.</li>
<li>Woocommerce login page protection.</li>
<li>Multi-site compatibility with extra MU settings.</li>
</ul>
To learn more read the following article: <a href="https://wpformation.com/wps-limit-login/" rel="nofollow ugc">https://wpformation.com/wps-limit-login</a>
This plugin is kindly proposed by <a href="https://www.wpserveur.net/?refwps=14&campaign=wpslimitlogin" rel="nofollow ugc">WPServeur</a> the specialized WordPress web host.
Découvrez également nos autres extensions gratuites : 
– <a href="https://wordpress.org/plugins/wps-hide-login/" rel="ugc">WPS Hide Login</a> to change your login URL to whatever you want. 
– <a href="https://wordpress.org/plugins/wps-bidouille/" rel="ugc">WPS Bidouille</a> to optimize your WordPress and get more info. 
– <a href="https://wordpress.org/plugins/wps-cleaner/" rel="ugc">WPS Cleaner</a> to clean your WordPress site.
This plugin is only maintained, which means we do not guarantee free support. Consider reporting a problem and be patient.

WPS Limit Login

WPS Limit login limit connection attempts by IP address

Simple Login Lockdown vs WPS Limit Login