Limit the number of login attempts that possible both through the normal login as well as using the auth cookies.
WordPress by default allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be cracked via brute-force relatively easily.
Limit Login Attempts Reloaded blocks an Internet address from making further attempts after a specified limit on retries has been reached, making a brute-force attack difficult or impossible.
- Limit the number of retry attempts when logging in (per each IP). This is fully customizable.
- Limit the number of attempts to log in using authorization cookies in the same way.
- Informs the user about the remaining retries or lockout time on the login page.
- Optional logging and optional email notification.
- Handles server behind the reverse proxy.
- It is possible to whitelist/blacklist IPs and Usernames.
- XMLRPC gateway protection.
- Woocommerce login page protection.
- Multi-site compatibility with extra MU settings.
Upgrading from the old Limit Login Attempts plugin
- Go to the Plugins section in your site’s backend.
- Remove the Limit Login Attempts plugin.
- Install the Limit Login Attempts Reloaded plugin.
All your settings will be kept in tact!
Many languages are currently supported in Limit Login Attempts Reloaded plugin but we welcome any additional ones.
Help us bring Limit Login Attempts Reloaded to even more cultures.
Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish
Das Plugin benutzt nur Standardaktionen und -filter.
Based on the original code from Limit Login Attemps plugin by Johan Eenfeldt.
Thanks for this 'reloaded' version. I used to install the old plugin per default in all WP installations but I now use your reloaded version. For newbies: This plugin works very well against attacks. I also recommend https://wordpress.org/plugins/rename-wp-login/ Change the wp-login page url to something different (and not the default suggestion of the plugin) works extremely well.
Thank you for "reloading" this simple, classic, useful plugin.
- Added Multi-site Compatibility and additional MU settings. https://wordpress.org/support/topic/multisite-compatibility-47/
- Usernames and IP addresses can be white-listed and black-listed now. https://wordpress.org/support/topic/banning-specific-usernames/ https://wordpress.org/support/topic/good-831/
- The lockouts log has been inversed. https://wordpress.org/support/topic/inverse-log/
- IP addresses can be white-listed now. https://wordpress.org/support/topic/legal-user/
- A „Gateway“ column is added to the lockouts log. It shows what endpoint an attacker was blocked from. https://wordpress.org/support/topic/xmlrpc-7/
- The „Undefined index: client_type“ error is fixed. https://wordpress.org/support/topic/php-notice-when-updating-settings-page/
- Removed the „Handle cookie login“ setting as they are now obsolete.
- Added bruteforce protection against Woocommerce login page attacks. https://wordpress.org/support/topic/how-to-integrate-with-woocommerce-2/
- Added bruteforce protection against XMLRPC attacks. https://wordpress.org/support/topic/xmlrpc-7/
- The site connection settings are now applied automatically and therefore have been removed from the admin interface.
- Now compatible with PHP 5.2 to support some older WP installations.
- fixed PHP Warning: Illegal offset type in isset or empty https://wordpress.org/support/topic/limit-login-attempts-generating-php-errors
- fixed the deprecated functions issue
- Fixed error with function arguments: https://wordpress.org/support/topic/warning-missing-argument-2-5
- added time stamp to unsuccessful tries on the plugin configuration page.
- fixed .po translation files issue.
- code refactoring and optimization.