How to Limit Login Attempts in WordPress

By default, WordPress allows unlimited login attempts, which leaves your site vulnerable to brute-force attacks. Limiting login attempts blocks attackers after a set number of failed tries. dotCanada recommends this as a basic security measure for every WordPress site.

Using Limit Login Attempts Reloaded

The most widely used plugin for this is Limit Login Attempts Reloaded, with millions of active installations.

1. Go to Plugins > Add New and search for Limit Login Attempts Reloaded.
2. Click Install Now, then Activate.
3. Navigate to Settings > Limit Login Attempts to configure the plugin.

Recommended Settings

• Allowed retries: 3 — lock out after three failed attempts
• Lockout period: 20 minutes for the first lockout
• Longer lockout: 24 hours after four lockouts
• Notify on lockout: enable email notifications to admin

You can also whitelist your own IP address to ensure you are never locked out of your own site. Check your current IP in the plugin settings and add it to the whitelist field.

Alternative: Wordfence

If you are already using Wordfence Security, it includes built-in brute-force protection and login attempt limiting, so you may not need a separate plugin.

For help configuring login protection on your dotCanada hosting account, contact our support team.