How to Limit Login Attempts in WordPress

By default WordPress lets anyone try to log in endlessly, which invites brute-force bots. Capping failed attempts shuts that attack down almost entirely.

Why it matters

Bots try thousands of username and password combinations against wp-login. Without a limit, they can keep guessing forever. Limiting attempts locks them out after a few failures, making the attack pointless.

Set it up

Install a login-limit plugin (some security plugins include it) and set a small number of allowed attempts and a lockout period. Legitimate users rarely fail more than a couple of times, so the impact on real people is minimal.

Combine with other defences

Pair attempt limits with strong passwords, two-factor authentication and a changed login URL. Together these make brute-force attacks effectively impossible.