Limiting WordPress Login Attempts: A Practical Security Checklist
Brute-force protection works best as a set of small controls rather than one dramatic lockout rule. The objective is to make automated guessing expensive while keeping legitimate administrators able to sign in and recover access.
Start with account hygiene
Remove dormant accounts, avoid predictable administrator usernames where practical, use a password manager and enable multi-factor authentication for users who can publish, install plugins or change site settings.
Add request throttling
Apply rate limits at the edge, web server or WordPress layer. Progressive delays and temporary blocks are generally friendlier than very long lockouts. Make sure limits also cover alternate authentication paths used by the site.
Account for proxies and shared networks
If a reverse proxy or CDN is in front of WordPress, configure trusted proxy headers correctly. Otherwise the site may see every visitor as the same address and block everyone after a few failures.
Monitor, then tune
Look at actual failed-login volume and false positives. Security rules should be adjusted from evidence. Keep logs long enough to investigate problems but set sensible retention so the database does not become a security-plugin archive.
Frequently asked questions
Is this different from the other login-attempt guide?
This page preserves a second historical URL while providing the same modern topic with a checklist-oriented structure.
Is CAPTCHA enough?
CAPTCHA can reduce automation but should not be the only login defence.
What is the safest lockout duration?
There is no universal value; short progressive delays are often safer for legitimate users than long fixed bans.