How to limit WordPress login attempts

WordPress, unmodified, lets anyone attempt to log in as many times as they like with no delay and no lockout. That is not an oversight anyone is likely to fix in core, because plenty of setups have reasons to leave it open — but for a normal site it means an automated script can try thousands of password combinations against your admin account, quietly, for as long as it wants, and WordPress will never say a word about it.

This kind of attack does not need to guess your specific password to be worth defending against. Attackers work through lists of commonly reused passwords against every site they can find a login form on, and it costs them almost nothing to keep trying. A lockout does not need to be sophisticated to stop this — it just needs to exist.

Method 1: a login-limiting plugin

The simplest and most common approach. A plugin built for this tracks failed login attempts per account and per IP address, and after a set number of failures within a set period, blocks further attempts for a cooldown period.

When configuring one, three settings matter:

• Attempt limit — commonly set to somewhere between three and five failed attempts before a lockout triggers. Low enough to stop rapid guessing, high enough that a person who genuinely mistypes their password twice is not immediately locked out.
• Lockout duration — a short lockout, extending automatically if the same source keeps trying afterwards, works better than one very long fixed lockout. It stops the attack without permanently blocking a legitimate user who shares an IP address with other people, such as on an office network.
• Notification email — most of these plugins can email you when a lockout occurs. Worth turning on for the first few weeks so you get a feel for how much automated traffic your login page normally attracts, then turning off if it becomes noise.

Method 2: password-protect wp-login.php at the server level

A second layer that stops requests before WordPress even processes them, which is more efficient than a plugin doing the same job in PHP on every attempt. This adds a basic authentication prompt — a separate username and password, unrelated to your WordPress account — in front of the login page itself.

Method 3: rename the login page

Automated attacks target the default location, /wp-login.php, because it is the same on every unmodified WordPress site. Moving the login form to a different, unpublished URL means the scripts scanning for the default location never find anything to attack in the first place. This is usually done with a plugin, since renaming the actual file breaks core functionality that expects it to exist at the standard path.

This is a genuinely effective reduction in automated traffic, but treat it as a convenience layer rather than a security measure on its own — anyone who finds the new URL, deliberately or by accident, faces exactly the same login form as before. Pair it with an actual lockout rather than relying on obscurity by itself.

The layer that matters more than any of the above

A lockout limits how many times an attacker can guess. Two-factor authentication makes correct guesses useless, because a stolen or correctly guessed password on its own is no longer enough to get in. If you can only add one additional layer of protection to a WordPress login, this is the one with the highest payoff — see turning on two-factor authentication.

Put together, a reasonable setup looks like this

• A login-limiting plugin with a short, escalating lockout.
• Two-factor authentication on every account with admin access.
• Unique passwords, generated rather than chosen, on every account — see choosing passwords worth having.
• No account named admin — see changing the WordPress admin username if an old install still has one.

None of these are individually complicated to set up, and together they take a login form from wide open to genuinely difficult to get through. See securing a WordPress site for the rest of what is worth doing beyond the login form itself.