Title: Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention Author: WPChef Published: 3, Agostu de 2016 Last modified: 23, Setiembre de 2026 --- Guetar plugins ![](https://ps.w.org/limit-login-attempts-reloaded/assets/banner-772x250.png?rev =2954981) ![](https://ps.w.org/limit-login-attempts-reloaded/assets/icon-256x256.png?rev=2456910) # Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention By [WPChef](https://profiles.wordpress.org/wpchefgadget/) [Download](https://downloads.wordpress.org/plugin/limit-login-attempts-reloaded.3.3.10.zip) * [Details](https://ast.wordpress.org/plugins/limit-login-attempts-reloaded/#description) * [Reviews](https://ast.wordpress.org/plugins/limit-login-attempts-reloaded/#reviews) * [Development](https://ast.wordpress.org/plugins/limit-login-attempts-reloaded/#developers) [Support](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/) ## Description Protect your WordPress website against brute force attacks, bot attacks, and unauthorized login attempts with one of the most trusted login security plugins for WordPress. [Limit Login Attempts Security](https://www.limitloginattempts.com) strengthens your WordPress login security by limiting failed login attempts, blocking malicious IPs, securing wp-login.php, protecting XML-RPC, and adding powerful firewall and 2FA protection without slowing down your website. Trusted by 2 million WordPress websites, Limit Login Attempts Security is designed specifically to protect the most targeted part of your website: the login page. #### Why Use Limit Login Attempts Security? By default, WordPress allows unlimited login attempts. This creates a major security vulnerability where bots and attackers can repeatedly guess usernames and passwords until they gain access. This is especially important in the age of AI, where attackers now have access to faster and more sophisticated tools than ever before. Limit Login Attempts Security helps stop: * Brute force attacks * Bot login attacks * Credential stuffing attacks * XML-RPC attacks * Unauthorized login attempts * WooCommerce login abuse * Malicious IP access attempts The plugin automatically blocks excessive login attempts and locks out suspicious IP addresses and usernames before attackers can gain access. #### Features Included in the Free Version **Login Security & Brute Force Protection** * Limit login attempts by IP address and username * Automatically lock out suspicious login activity * Adjustable lockout duration and retry limits * Protect wp-login.php from automated attacks * Prevent brute force login attacks **2FA / Multi-Factor Authentication (MFA)** * Built-in two-factor authentication (2FA) * Add an additional layer of login protection * Improve WordPress account security * Secure administrator and user logins **Firewall & Bot Protection** * Block malicious login requests * Detect suspicious login behavior * Reduce bot-based login attacks * Lightweight firewall-focused login protection **WooCommerce & Plugin Compatibility** Protects: * WooCommerce login pages * XML-RPC login requests * Custom login pages * WordPress multisite installations Compatible With: * Wordfence * Sucuri * Ultimate Member * MemberPress * WPS Hide Login * Cloudflare and reverse proxy setups **Login Monitoring & Notifications** * Failed login attempt logs * Lockout email notifications * Denied attempt tracking * Login retry visibility for users **Access Controls** * IP safelist and denylist support * Username safelist and denylist support * IPv6 range support * Custom IP origin configuration #### Premium Features (Start Your Free 14 Day Trial) [Upgrade to Limit Login Attempts Security Premium](https://www.limitloginattempts.com/plans/) to extend protection with cloud-based login security and advanced attack prevention. **Advanced Cloud Protection** * Real-time malicious IP intelligence * Global denylist protection * Synchronized lockouts across websites * Auto IP denylist generation * Cloud-based login attack mitigation **Enhanced Performance Protection** * Offload excessive failed login requests from your server * Reduce server strain during attacks * Improve stability under heavy attack conditions **Advanced Security Features** * Country-based login blocking * Enhanced throttling and lockout escalation * Registration page protection * Successful login tracking * Enhanced lockout analytics and geolocation data **Multi-Site & Team Features** * Shared safelist and denylist syncing * Shared lockout protection between domains * Cloud backups of IP security data * CSV exports of login and IP activity **Premium Support** * Access to security-focused support specialists * Faster troubleshooting and assistance #### Lightweight Security Built for WordPress Unlike many large security suites, Limit Login Attempts Security focuses specifically on login security and brute force protection. This means: * Faster performance * Less server overhead * Easier configuration * Strong protection without unnecessary bloat #### Protect More Than Just wp-login.php Limit Login Attempts Security secures: * wp-login.php * XML-RPC * WooCommerce logins * Custom login forms * Registration pages * Multisite logins #### Trusted by Millions of WordPress Websites Limit Login Attempts Security is one of the most widely used WordPress login security plugins and has helped protect millions of websites from brute force attacks and malicious login activity. Whether you run: * A personal blog * WooCommerce store * Membership website * Agency * Business website * Enterprise WordPress network Limit Login Attempts Security helps secure your login experience with modern WordPress login protection. #### Upgrading from the Original Limit Login Attempts Plugin? Switching is easy: 1. Remove the old Limit Login Attempts plugin 2. Install Limit Login Attempts Security 3. Your settings will remain intact #### Translation Support Currently translated into multiple languages including: * Spanish * French * German * Dutch * Turkish * Swedish * Russian * Romanian * Chinese (Traditional) * Brazilian Portuguese * And more #### Secure Your WordPress Login Today Install Limit Login Attempts Security and protect your WordPress website with: * Login security * Two-Factor Authentication (2FA) * Brute force protection * Firewall security * Bot protection * XML-RPC protection * WooCommerce login protection Without slowing down your website. ## Screenshots [[ [[ [[ [[ [[ [[ [[ [[ ## FAQ ### What do I do if all users get blocked? If you are using contemporary hosting, it’s likely your site uses a proxy domain service like CloudFlare, Sucuri, Nginx, etc. They replace your user’s IP address with their own. If the server where your site runs is not configured properly (this happens a lot) all users will get the same IP address. This also applies to bots and hackers. Therefore, locking one user will lead to locking everybody else out. If the plugin is not using our [Cloud App](https://www.limitloginattempts.com/plans/), this can be adjusted using the Trusted IP Origin setting. The cloud service intelligently recognizes the non-standard IP origins and handles them correctly, even if your hosting provider does not. ### How do I know if I’m under attack? An easy way to check if the attack is legitimate is to copy the IP address from the lockout notification and check its location using a IP locator tool. If the location is not somewhere you recognize and you have received several failed login attempts, then you are likely being attacked. You might notice dozens or hundreds of IPs each day. Visit our website to learn how can you [prevent brute force attacks](https://www.limitloginattempts.com/brute-force-attack-protection-the-best-tools-tips-to-keep-your-website-safe/) on your website. ### How can I tell that the premium plugin is working? After you upgrade to our premium version, you will see a new dashboard in your WordPress admin that shows all attacks that will now relay through our cloud service. On the graph, you’ll see **requests** and **failed login attempts**. Each request will represent the cloud app validating an IP, which also includes denied logins. In some cases, you may notice an increase in speed and efficiency with your website. Also, a reduction in lockout notifications via email. ### Could these failed login attempts be fake? Some users find it hard to believe that they could experience numerous unsuccessful login attempts, particularly when their site has just been established or has minimal human traffic. The plugin is not responsible for generating these failed login attempts. Newly created websites are frequently hosted on shared IP addresses, making it easy for hackers to discover them. Additionally, newly registered domain names are often crawled soon after creation, rendering a WordPress website susceptible to attacks. Such websites are attractive targets as security is not a primary concern for their owners. We’ve created an article that delves deeper into the issue of [fake login attempts in WordPress](https://www.limitloginattempts.com/could-these-failed-login-attempts-be-fake/). ### What happens if my site exceeds the request limits in the plan? The premium plan’s resource limits start from 100,000 requests per month, which should accept almost any heavy brute-force attack. We monitor all of our sites and will alert the user if it appears they are going over their limits. If limits are reached, we will suggest to the user upgrading to the next plan. If you are using the free version, the load caused by brute force attacks will be absorbed by your current hosting bandwidth, which could cause your hosting costs to increase. ### What URLs are being attacked and protected? The URLs being protected are your login page (wp-login.php, wp-admin), xmlrpc.php, WooCommerce login page, and any custom login page you have that uses regular WordPress login hooks. ### Why is Limit Login Attempts Security more popular than other brute-force protection plugins? Our main focus is protecting your site from brute force attacks. This allows our plugin to be very lean and effective. It doesn’t require a lot of your web hosting resources and keeps your site well-protected. More importantly, it does all of this automatically as our service learns on its own about each IP it encounters. In contrast, a firewall would require manual [blocking of IPs](https://www.limitloginattempts.com/should-i-block-ip-addresses/). ### What to do when an admin gets blocked? Open the site from another IP. You can do this from your cell phone, or using Opera browser and enabling free VPN there. You can also try turning off your router for a few minutes and then see if you get a different IP address. These will work if your hosting server is configured correctly. If that doesn’t work, connect to the site using FTP or your hosting control panel file manager. Navigate to wp-content/ plugins/ and rename the limit-login-attempts-reloaded folder. Log in to the site then rename that folder back and whitelist your IP. By upgrading to our premium app, you will have the unlocking functionality right from the cloud so you’ll never have to deal with this issue. ### What settings should I use In the plugin? The settings are explained within the plugin in great detail. If you are unsure, use the default settings as they are the recommended ones. ### Can I share the safelist/denylist throughout all of my sites? By default, you will need to copy and paste the lists to each site manually. For the [premium service](https://www.limitloginattempts.com/plans/?from=wp-details), sites are grouped within the same private cloud account. Each site within that group can be configured if it shares its lockouts and access lists with other group members. The setting is located in the plugin’s interface. The default options are recommended. ## Reviews ![](https://secure.gravatar.com/avatar/5e74b249a618dc33ee85ec33d1dc113a06cb801ae8cc96ddca99a7c1395fbce9? s=60&d=retro&r=g) ### 󠀁[one of the best security-tools 👍️](https://wordpress.org/support/topic/one-of-the-best-security-tools-%f0%9f%91%8d%ef%b8%8f/)󠁿 [robbb](https://profiles.wordpress.org/robbb/) 8, Ochobre de 2026 itś one of my standard plugins, I use on every single site. Itś perfect to check out, how many attempts to login into your WP-admin happened. I love it. ❤️ ![](https://secure.gravatar.com/avatar/453a8c8eb7119b0b74c99db0fe00a3afe488e993eff9eaba9892b24b07c2f1ed? s=60&d=retro&r=g) ### 󠀁[Отлично!](https://wordpress.org/support/topic/%d0%be%d1%82%d0%bb%d0%b8%d1%87%d0%bd%d0%be-348/)󠁿 [staszukov1](https://profiles.wordpress.org/staszukov1/) 7, Ochobre de 2026 Всё работает как надо. Проблем не обнаруженно. ![](https://secure.gravatar.com/avatar/e254eb67f11fbc254d0fac8060b3347e3e54769e3852a61e3e2bda23b9d3e07e? s=60&d=retro&r=g) ### 󠀁[Excelente, essencial para a proteção do site.](https://wordpress.org/support/topic/excelente-essencial-para-a-protecao-do-site/)󠁿 [flaviopereira](https://profiles.wordpress.org/flaviopereira/) 8, Setiembre de 2026 Muito bom, realmente funciona. Obrigado. ![](https://secure.gravatar.com/avatar/524caea6b1dc0aa59d2bb517b997ff18a8eed1d6803bfc84c1f700792f8b4fc1? s=60&d=retro&r=g) ### 󠀁[Πάρα πολύ καλό!!!](https://wordpress.org/support/topic/%cf%80%ce%ac%cf%81%ce%b1-%cf%80%ce%bf%ce%bb%cf%8d-%ce%ba%ce%b1%ce%bb%cf%8c-2/)󠁿 [skorodimos](https://profiles.wordpress.org/skorodimos/) 7, Setiembre de 2026 Πάρα πολύ καλό!!! ![](https://secure.gravatar.com/avatar/d1f2793f61f96564693b5958b641458e516f11e4a6251ed00f6bc5d798d195e5? s=60&d=retro&r=g) ### 󠀁[Por el momento funciona de 10.](https://wordpress.org/support/topic/por-el-momento-funciona-de-10/)󠁿 [Javier](https://profiles.wordpress.org/glowak/) 2, Setiembre de 2026 Todo excelente por el momento. ![](https://secure.gravatar.com/avatar/0ac388cc6cb1e6464beaeed2421a2cd79b1760f0c58265f5261269297d021b69? s=60&d=retro&r=g) ### 󠀁[Vraiment parfait](https://wordpress.org/support/topic/vraiment-parfait-5/)󠁿 [kerdelhué](https://profiles.wordpress.org/franckyxp/) 1, Setiembre de 2026 Ce plugin fait le job, que demander de plus. [ Read all 1.485 reviews ](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/reviews/) ## Contributors & Developers “Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention” is open source software. The following people have contributed to this plugin. Contributors * [ WPChef ](https://profiles.wordpress.org/wpchefgadget/) * [ nikita.global ](https://profiles.wordpress.org/nikitaglobal/) “Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention” has been translated into 38 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/limit-login-attempts-reloaded/contributors) for their contributions. [Translate “Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention” into your language.](https://translate.wordpress.org/projects/wp-plugins/limit-login-attempts-reloaded) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/limit-login-attempts-reloaded/), check out the [SVN repository](https://plugins.svn.wordpress.org/limit-login-attempts-reloaded/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/limit-login-attempts-reloaded/) by [RSS](https://plugins.trac.wordpress.org/log/limit-login-attempts-reloaded/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 3.3.10 * Added detection of a cached or optimizer-stripped login page and an admin notice warning that it can break the email code (MFA) login flow. * Fixed the onboarding Micro Cloud step silently completing on activation errors; it now shows the server error message so users learn when the program is closed or trial is unavailable. * Added a compatibility table to the Debug tab showing which LLAR features work with popular third-party plugins. * Redesigned the lockout notification email. #### 3.3.9 * Reworked the premium tab upgrade CTAs to show plan-specific pricing and adapt the upgrade links to the currently installed plan. * Added Micro Cloud usage banners that show the monthly requests used and warn when the quota is almost exhausted. * Updated the lockout notification email with a new premium upgrade call to action. * Fixed the cloud Active Lockouts widget showing too few lockouts by auto-loading additional pages when a short batch did not fill the list. * Fixed the local denylist still blocking logins in cloud mode after the cloud ACL allowed them; local rules now apply only as a failover when the cloud ACL is unavailable. * Fixed WooCommerce customers being unable to register during checkout when cloud registration limiting was enabled; account creation is now allowed during checkout while standalone registration forms stay protected. #### 3.3.8 * Added Personal and Business plans to the premium comparison table and made the displayed plans adapt to the currently installed plan. * Aligned dashicons across the logs, premium, ACL and help admin pages for WordPress 7 compatibility. * Fixed the failed-login page script being blocked under a nonce-based Content Security Policy by printing it with wp_get_inline_script_tag(). Thanks to Oskar Schöldström (@oxyc) for the pull request. * Fixed the denylist matching the account email when only the username was listed; now the submitted login is matched literally (case-insensitive), while explicit email entries still apply. #### 3.3.7 * Fixed PHP warnings when a cloud app custom setting is missing the label, description, or value field. * Added the SameSite=Lax attribute to the login flow cookie for better CSRF protection. * Fixed dashicons line-height on all admin pages and dashboard widgets for WordPress 7 compatibility. * Fixed the cloud app setup so it verifies the setup code was saved before activating the custom app, preventing an inconsistent state on storage errors. * Fixed the review admin notice buttons not working because its inline script was being stripped by output sanitization. * Fixed the Micro Cloud setup so it surfaces the actual server error message to admins and handles an incomplete app configuration gracefully instead of failing silently. #### 3.3.6 * Refactored the core plugin class into smaller services. #### 3.3.5 * Hardened denylist matching to make username blocking more reliable and consistent. Thanks to Artus KG for finding and reporting this issue. #### 3.3.4 * Fixed icon positioning. #### 3.3.3 * Fixed the dashboard incorrectly showing a network error when the cloud API is reachable but access is restricted. * Fixed a PHP 8.1+ deprecation notice by avoiding implicit float-to-int conversion in the lockout email notification check. * Made the email digest labels (Daily/Weekly/Monthly) and preview text translatable. * Allowed safelisted usernames (matched case-insensitively, including by email) to bypass lockouts and the MFA prompt on login. #### 3.3.2 * Improved usage information in cloud mode. #### Earlier versions For the changelog of earlier versions, please refer to the [changelog.txt](https://plugins.svn.wordpress.org/limit-login-attempts-reloaded/trunk/changelog.txt) file. ## Meta * Version **3.3.10** * Last updated **2 selmanes ago** * Active installations **1+ million** * WordPress version ** 5.0 or higher ** * Tested up to **7.1.3** * Languages * [Asturian](https://ast.wordpress.org/plugins/limit-login-attempts-reloaded/), [Catalan](https://ca.wordpress.org/plugins/limit-login-attempts-reloaded/), [Chinese (China)](https://cn.wordpress.org/plugins/limit-login-attempts-reloaded/), [Chinese (Taiwan)](https://tw.wordpress.org/plugins/limit-login-attempts-reloaded/), [Czech](https://cs.wordpress.org/plugins/limit-login-attempts-reloaded/), [Danish](https://da.wordpress.org/plugins/limit-login-attempts-reloaded/), [Dutch](https://nl.wordpress.org/plugins/limit-login-attempts-reloaded/), [Dutch (Belgium)](https://nl-be.wordpress.org/plugins/limit-login-attempts-reloaded/), [English (Australia)](https://en-au.wordpress.org/plugins/limit-login-attempts-reloaded/), [English (Canada)](https://en-ca.wordpress.org/plugins/limit-login-attempts-reloaded/), [English (New Zealand)](https://en-nz.wordpress.org/plugins/limit-login-attempts-reloaded/), [English (South Africa)](https://en-za.wordpress.org/plugins/limit-login-attempts-reloaded/), [English (UK)](https://en-gb.wordpress.org/plugins/limit-login-attempts-reloaded/), [English (US)](https://wordpress.org/plugins/limit-login-attempts-reloaded/), [French (Canada)](https://fr-ca.wordpress.org/plugins/limit-login-attempts-reloaded/), [French (France)](https://fr.wordpress.org/plugins/limit-login-attempts-reloaded/), [Galician](https://gl.wordpress.org/plugins/limit-login-attempts-reloaded/), [German](https://de.wordpress.org/plugins/limit-login-attempts-reloaded/), [Italian](https://it.wordpress.org/plugins/limit-login-attempts-reloaded/), [Japanese](https://ja.wordpress.org/plugins/limit-login-attempts-reloaded/), [Korean](https://ko.wordpress.org/plugins/limit-login-attempts-reloaded/), [Norwegian (Bokmål)](https://nb.wordpress.org/plugins/limit-login-attempts-reloaded/), [Persian](https://fa.wordpress.org/plugins/limit-login-attempts-reloaded/), [Polish](https://pl.wordpress.org/plugins/limit-login-attempts-reloaded/), [Portuguese (Brazil)](https://br.wordpress.org/plugins/limit-login-attempts-reloaded/), [Portuguese (Portugal)](https://pt.wordpress.org/plugins/limit-login-attempts-reloaded/), [Romanian](https://ro.wordpress.org/plugins/limit-login-attempts-reloaded/), [Russian](https://ru.wordpress.org/plugins/limit-login-attempts-reloaded/), [Serbian](https://sr.wordpress.org/plugins/limit-login-attempts-reloaded/), [Spanish (Argentina)](https://es-ar.wordpress.org/plugins/limit-login-attempts-reloaded/), [Spanish (Chile)](https://cl.wordpress.org/plugins/limit-login-attempts-reloaded/), [Spanish (Colombia)](https://es-co.wordpress.org/plugins/limit-login-attempts-reloaded/), [Spanish (Ecuador)](https://es-ec.wordpress.org/plugins/limit-login-attempts-reloaded/), [Spanish (Mexico)](https://es-mx.wordpress.org/plugins/limit-login-attempts-reloaded/), [Spanish (Spain)](https://es.wordpress.org/plugins/limit-login-attempts-reloaded/), [Spanish (Venezuela)](https://ve.wordpress.org/plugins/limit-login-attempts-reloaded/), [Swedish](https://sv.wordpress.org/plugins/limit-login-attempts-reloaded/), [Turkish](https://tr.wordpress.org/plugins/limit-login-attempts-reloaded/) y [Ukrainian](https://uk.wordpress.org/plugins/limit-login-attempts-reloaded/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/limit-login-attempts-reloaded) * Tags * [2FA](https://ast.wordpress.org/plugins/tags/2fa/)[Brute Force](https://ast.wordpress.org/plugins/tags/brute-force/) [firewall](https://ast.wordpress.org/plugins/tags/firewall/)[login security](https://ast.wordpress.org/plugins/tags/login-security/) [security](https://ast.wordpress.org/plugins/tags/security/) * [Advanced View](https://ast.wordpress.org/plugins/limit-login-attempts-reloaded/advanced/) ## Ratings 4.8 out of 5 stars. * [ 1.399 5-star reviews ](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/reviews/?filter=5) * [ 31 4-star reviews ](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/reviews/?filter=4) * [ 8 3-star reviews ](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/reviews/?filter=3) * [ 10 2-star reviews ](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/reviews/?filter=2) * [ 37 1-star reviews ](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/reviews/) ## Contributors * [ WPChef ](https://profiles.wordpress.org/wpchefgadget/) * [ nikita.global ](https://profiles.wordpress.org/nikitaglobal/) ## Support Issues resolved in last two months: 7 out of 13 [View support forum](https://wordpress.org/support/plugin/limit-login-attempts-reloaded/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://www.paypal.com/donate?hosted_button_id=FKD4MYFCMNVQQ)