How to Limit WordPress Login Attempts — and Why Rate Limiting Matters
Repeated login attempts are a normal part of operating a public WordPress site. Rate limiting does not replace strong passwords or multi-factor authentication, but it reduces automated guessing and can lower unnecessary work on the application and server.
What login limiting actually does
A rate limit slows or temporarily blocks repeated authentication attempts based on signals such as account name, IP address or request rate. Good implementations avoid permanent lockouts that an attacker could deliberately trigger against legitimate users.
Use layered authentication controls
Combine rate limiting with unique passwords, multi-factor authentication for privileged accounts and removal of unused administrators. Where practical, protect alternate authentication routes too, including XML-RPC or API endpoints that can be abused for credential attacks.
Choose thresholds carefully
Very aggressive limits can punish offices, schools or mobile networks where many users share an IP address. Prefer progressive delays, short lockout windows and monitoring over simplistic “three failures forever” rules.
Operational checks
Confirm that failed-login logging does not grow without bounds, that legitimate password resets still work and that your CDN, proxy or web server passes the real client IP correctly. Test after security-plugin and reverse-proxy changes.
Frequently asked questions
Does limiting login attempts stop all brute-force attacks?
No. It raises the cost of repeated guessing but should be combined with strong credentials and MFA.
Can a CDN provide rate limiting?
Many can, and server-level controls may reduce load before requests reach WordPress.
Should I hide the login URL?
It can reduce noise, but it is not a substitute for authentication security.