Beschreibung
Limit the number of login attempts that possible both through the normal login as well as using the auth cookies.
WordPress by default allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be cracked via brute-force relatively easily.
Limit Login Attempts Reloaded blocks an Internet address from making further attempts after a specified limit on retries has been reached, making a brute-force attack difficult or impossible.
Funktionen:
- Limit the number of retry attempts when logging in (per each IP). This is fully customizable.
- Limit the number of attempts to log in using authorization cookies in the same way.
- Informs the user about the remaining retries or lockout time on the login page.
- Optional logging and optional email notification.
- Handles server behind the reverse proxy.
- It is possible to whitelist/blacklist IPs and Usernames.
- XMLRPC gateway protection.
- Woocommerce login page protection.
- Multi-site compatibility with extra MU settings.
Upgrading from the old Limit Login Attempts plugin
- Go to the Plugins section in your site’s backend.
- Remove the Limit Login Attempts plugin.
- Install the Limit Login Attempts Reloaded plugin.
All your settings will be kept in tact!
Many languages are currently supported in Limit Login Attempts Reloaded plugin but we welcome any additional ones.
Help us bring Limit Login Attempts Reloaded to even more cultures.
Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish
Das Plugin benutzt nur Standardaktionen und -filter.
Based on the original code from Limit Login Attemps plugin by Johan Eenfeldt.
Screenshots
Loginscreen after a failed login with remaining retries 
Lockout loginscreen 
Administration interface in WordPress 4.5.3
Rezensionen
Fantastic
Hi WPChef,
Thank you for this upgraded version of the classic limit-login-attempts Plugin. It is perfect for restricting brute force attacks. It does what it is made to do and it does this fantastically.
I, and I am sure many others, really appreciate the work you have done on this plugin to insure that websites are better protected.
Best wishes and continued success with this project and all you do.
Steve
Useful and easy to setup
Really good Plugin thanks a lot.
—
Sehr gutes Plugin, vielen Dank.
Safe!
Since I use this plugin I’m startled how often my website is beeing attacked!
Thank you for this usefull plugin!
Long time user
Thanks for this ‚reloaded‘ version. I used to install the old plugin per default in all WP installations but I now use your reloaded version.
For newbies: This plugin works very well against attacks. I also recommend https://wordpress.org/plugins/rename-wp-login/
Change the wp-login page url to something different (and not the default suggestion of the plugin) works extremely well.
Thanks WPChef
Thank you for „reloading“ this simple, classic, useful plugin.
Nice Work
This plugin is doing the job. Easy to configure (Relatively to fail2ban configuration). It has already blocked 2 russian IPs. Thanks!!
Mitwirkende & Entwickler
„Limit Login Attempts Reloaded“ ist Open-Source-Software. Folgende Menschen haben an diesem Plugin mitgewirkt:
Mitwirkende
„Limit Login Attempts Reloaded“ wurde in 2 Sprachen übersetzt. Danke an die Übersetzerinnen und Übersetzer für ihre Mitwirkung.
Übersetze „Limit Login Attempts Reloaded“ in deine Sprache.
Interessiert an der Entwicklung?
Durchstöbere den Code, sieh dir das SVN Repository an oder abonniere das Entwicklungsprotokoll per RSS.
Changelog
2.6.1
Plugin returns the 403 Forbidden header after the limit of login attempts via XMLRPC is reached.
Added support of IP ranges in white/black lists.
Lockouts now can be released selectively.
Fixed the issue with encoding of special symbols in email notifications.
2.5.0
- Added Multi-site Compatibility and additional MU settings. https://wordpress.org/support/topic/multisite-compatibility-47/
2.4.0
- Usernames and IP addresses can be white-listed and black-listed now. https://wordpress.org/support/topic/banning-specific-usernames/ https://wordpress.org/support/topic/good-831/
- The lockouts log has been inversed. https://wordpress.org/support/topic/inverse-log/
2.3.0
- IP addresses can be white-listed now. https://wordpress.org/support/topic/legal-user/
- A „Gateway“ column is added to the lockouts log. It shows what endpoint an attacker was blocked from. https://wordpress.org/support/topic/xmlrpc-7/
- The „Undefined index: client_type“ error is fixed. https://wordpress.org/support/topic/php-notice-when-updating-settings-page/
2.2.0
- Removed the „Handle cookie login“ setting as they are now obsolete.
- Added bruteforce protection against Woocommerce login page attacks. https://wordpress.org/support/topic/how-to-integrate-with-woocommerce-2/
- Added bruteforce protection against XMLRPC attacks. https://wordpress.org/support/topic/xmlrpc-7/
2.1.0
- The site connection settings are now applied automatically and therefore have been removed from the admin interface.
- Now compatible with PHP 5.2 to support some older WP installations.
2.0.0
- fixed PHP Warning: Illegal offset type in isset or empty https://wordpress.org/support/topic/limit-login-attempts-generating-php-errors
- fixed the deprecated functions issue
https://wordpress.org/support/topic/using-deprecated-function - Fixed error with function arguments: https://wordpress.org/support/topic/warning-missing-argument-2-5
- added time stamp to unsuccessful tries on the plugin configuration page.
- fixed .po translation files issue.
- code refactoring and optimization.
