Your WordPress login page gets hit by bots constantly. Not occasionally. Constantly. Every hour of every day, automated scripts are trying combinations of usernames and passwords against your wp-login.php page, hoping something sticks. Left unchecked, this can slow your site down, fill your logs with noise, and occasionally succeed against weak passwords.
The obvious fix is to limit login attempts. But do it wrong and you'll lock out legitimate users, block your own team by accident, or annoy people so much they stop trying. Here's how to get the balance right.
Why Limiting Login Attempts Matters
Brute force attacks work on volume. A bot doesn't get tired or discouraged. It just keeps guessing, sometimes thousands of times per hour, until it finds a match or gives up on your site and moves to the next target.
Even if the attack never succeeds, it still costs you something. Failed login requests still consume server resources. On a site with heavy traffic already, that extra load can show up as slower page times for real visitors. We've covered this kind of login pressure in WordPress Login Security: Simple Changes That Stop the Majority of Brute Force Attempts, and limiting attempts is one of the core pieces of that puzzle.
The Problem With Aggressive Lockout Rules
Here's where a lot of site owners overcorrect. They set the login limit to something like 2 attempts before a 24-hour lockout, and then wonder why their own marketing manager got locked out for a full day because she fat-fingered her password twice before her coffee kicked in.
A good login limiting setup balances two goals:
- Stop automated bots from grinding through password combinations
- Give real humans room to make a normal mistake without getting punished
Humans mistype passwords. They forget which of their three password variations they used. They get locked out of their password manager. None of that is malicious, and your security setup shouldn't treat it that way.
Setting Limits That Actually Make Sense
1. Use a Reasonable Attempt Threshold
Instead of locking someone out after 2 or 3 failed tries, aim for something like 5 attempts before any lockout kicks in. This gives real users enough room for typos while still cutting off bots quickly, since automated tools typically fail dozens or hundreds of times per session.
2. Use Progressive Lockout Times
Rather than one harsh lockout period, scale it up gradually:
- First lockout: 5-10 minutes
- Second lockout: 30 minutes to an hour
- Repeated lockouts: 24 hours
This approach is far friendlier to real users. Someone who forgot their password waits a few minutes and tries again with a reset link. A bot that keeps hammering the same account eventually gets locked out for a full day, which makes the attack pointless.
3. Lock by IP and Username Combination
Locking by IP alone can backfire on shared networks, like an office or coworking space where multiple employees share one public IP address. If one person mistypes their password enough times, everyone on that network gets blocked.
Locking by username alone has the opposite problem. An attacker can rotate through many usernames from a single IP and never trigger a lockout. The better approach combines both: track failed attempts per IP-username pair, so legitimate coworkers aren't punished for someone else's typo, but a bot targeting a specific account still gets shut down.
Recommended Plugins for Limiting Login Attempts
If you want to handle this at the plugin level, a few options consistently perform well:
- Limit Login Attempts Reloaded - lightweight, simple to configure, and handles the IP/username combination well
- WP Limit Login Attempts - similar functionality with a cleaner interface for beginners
- Wordfence - includes login limiting as part of a broader security suite, useful if you want more than just this one piece
Whichever you pick, go into the settings right away and adjust the defaults. Most plugins ship with settings that are either too lenient (doing almost nothing) or too strict (locking out real users constantly). Don't leave it on default and assume it's tuned correctly for your traffic.
Add Two-Factor Authentication as a Second Layer
Limiting login attempts slows down brute force attacks, but it doesn't stop a determined attacker who already has a leaked password from a data breach somewhere else. That's where two-factor authentication earns its place. Even if someone gets your password right, they still need the code from your phone to get in.
We wrote a full walkthrough on this in How to Set Up Two-Factor Authentication on WordPress in Under Ten Minutes, and pairing it with login limits gives you two very different types of protection working together.
Consider Moving Protection to the Hosting Level
Plugins are a fine starting point, but they run inside WordPress itself, which means every blocked login attempt still has to load PHP and hit your database before it gets rejected. That's not ideal if you're dealing with a serious flood of attempts.
A cleaner approach is stopping malicious requests before they ever reach WordPress. A web application firewall can filter out known bad actors and suspicious request patterns at the server level, so your site never even has to process them. If you're curious how that layer works, our WAF overview covers the mechanics in more detail. Some hosts also let you block specific IP ranges directly through the firewall, which is useful if you're seeing repeated attacks from the same source.
A Quick Checklist
- Set attempt thresholds around 5, not 2 or 3
- Use progressive lockout timing instead of one harsh penalty
- Lock by IP and username together, not either alone
- Add two-factor authentication as a backup layer
- Consider pushing bad requests to the hosting/firewall level for busier sites
Limiting login attempts is one of the simplest security wins available on WordPress. Set it up thoughtfully, and it quietly blocks the vast majority of bot traffic without your real users ever noticing it's there.
