Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Limit repeated WordPress login attempts to slow automated brute-force guessing and credential stuffing. The strongest design blocks abusive traffic at a CDN, web-application firewall (WAF), host, or web-server layer before it reaches PHP. If those controls are unavailable, a maintained WordPress security plugin can throttle attempts inside the application. Rate limiting works best alongside unique passwords and phishing-resistant authentication for administrators.
What limiting login attempts stops
A brute-force attack repeatedly tries usernames and passwords until one works. Credential stuffing is a related attack that tests username-password pairs exposed in unrelated breaches. A rate limit counts failed attempts and temporarily blocks further attempts from an IP address, account, or other identifier. This makes high-volume guessing slower and more expensive, but it cannot make a reused or weak password safe.
Wordfence reported more than 55 billion password-hacking attempts, including brute-force and credential-stuffing activity, from nearly 136 million distinct attacking IP addresses in its 2024 Annual WordPress Security Report. That is a vendor-reported figure, not an independent census of every attack worldwide, but it illustrates why an internet-facing login needs a throttle.
Where the control should run
| Control location | What it does | Advantages | Trade-offs |
|---|---|---|---|
| CDN, WAF, or managed host | Filters requests at the network edge, before they reach your server | Preserves PHP and WordPress resources; can absorb large bursts | Available settings and route coverage vary by provider |
| Web server | Applies rules in the server handling HTTP requests | Earlier filtering than WordPress; useful when you control the server | Requires the right server modules, careful syntax, and staging tests |
| WordPress plugin | Counts and blocks attempts in PHP | Accessible on hosts without edge or server rate limiting; often includes logs and lockout controls | PHP still handles the request, so heavy attacks consume application resources; overlapping plugins can conflict |
WordPress guidance recommends edge or server throttling when available: application plugins execute within PHP and therefore still consume resources under heavy attack. Use a plugin as the fallback when your host or CDN cannot provide an effective limit.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
Check every login surface your site uses
Protecting only wp-login.php can leave another authentication route exposed. Inventory the routes enabled by your installation and confirm that the chosen control covers them.
- Standard login:
wp-login.phpand any front-end form that submits to it. - XML-RPC: WordPress guidance says to disable it when you do not need it. If it is required, restrict and rate-limit it.
- WooCommerce and custom forms: shops and membership sites may authenticate through forms that a basic login rule does not automatically cover.
- Registration and password reset: these endpoints can be abused even when ordinary login is throttled.
- Multisite: network and site-level login behavior may differ.
The WordPress.org listing for the Limit Login Attempts Security plugin describes coverage for wp-login.php, XML-RPC, WooCommerce, custom login forms, registration, and multisite. Treat a directory description as a starting point: verify the current plugin version, settings, and your actual request paths before relying on it.
How to choose a lockout threshold
Configure three separate values: how many failures count, the time window in which they count, and how long the lockout lasts. A very low threshold frustrates people who mistype a password; a very high threshold gives an attacker more guesses. Shared offices, schools, mobile carriers, and VPNs can put many legitimate users behind one public IP, so an IP-only rule can create false positives.
There is no universal correct number. Wordfence notes that real users commonly make five or more mistakes while trying to remember a username or password. Its product documentation suggests starting with 20 failed login attempts and five failed password-reset attempts for many sites. Those are Wordfence’s product-specific starting suggestions, not a security standard or benchmark. Adjust them after observing your site’s normal traffic and attack pattern.
Implementation paths
Use a host, CDN, or WAF rule
- Identify the provider’s rate-limiting or bot-protection control and the exact paths it evaluates.
- Set a rule for failed authentication requests, including any XML-RPC, commerce, membership, or custom endpoints you use.
- Allow trusted monitoring or administrative networks only when you can maintain that allowlist securely.
- Stage the rule first, then test a normal login, a wrong-password sequence, password reset, and every custom login flow.
- Enable logging and alerts so you can distinguish an attack from a misconfigured rule.
Use a server rule
Server-level throttling can stop requests before WordPress runs, but the exact directives depend on the web server and available modules. Apply changes in staging, validate the configuration, and keep console or hosting-panel access available for rollback. Do not paste a rule designed for one server into another without checking its syntax and request variables.
Use a WordPress plugin
- Choose a maintained plugin whose documented routes match your site; a focused login-limiting plugin may be sufficient, while an all-in-one security suite may already include brute-force protection.
- Record your current security settings and confirm that another plugin or host rule is not already counting the same failures.
- Set the failure count, counting period, and lockout duration. Start with a deliberately testable policy rather than the most aggressive setting.
- Test ordinary login, intentional failures, password reset, XML-RPC if enabled, and custom or WooCommerce forms.
- Review lockout logs after launch and tune the policy for real users, shared networks, and attack volume.
Wordfence documents lockouts by IP after a configured number of failures for a chosen period. Its brute-force protection documentation is useful for understanding those controls, but settings and behavior depend on the product version.
Build recovery into the design
Before enabling a strict policy, decide how an administrator will regain access. Keep a supported recovery path, such as a second administrator account governed by your normal security policy, host or server access, and documented steps for disabling the plugin or rule. Test that path with your host or plugin in a non-production environment when possible. Do not assume a single universal unlock procedure: the correct method depends on where the lockout is enforced.
Pair rate limiting with stronger authentication
- Use a unique, long password for every WordPress account, especially administrators.
- Enable administrator two-factor authentication. WordPress core does not include 2FA, so use a maintained plugin or an identity provider that supports it.
- Consider passkeys based on WebAuthn, which are designed to resist phishing and eliminate reusable passwords during sign-in. A compatible FIDO2 security key is an optional hardware form of this approach; verify compatibility with your chosen WordPress authentication system before buying one.
- Disable XML-RPC if no connected service requires it; otherwise restrict and rate-limit it.
- Keep WordPress, themes, plugins, and the hosting stack updated, because login throttling does not fix vulnerabilities elsewhere.
Common mistakes and symptoms
Locking out legitimate users too quickly
Symptoms include support requests from people who mistyped credentials, especially on shared networks. Increase the failure allowance or shorten the lockout only after checking logs, and provide a documented reset route.
Protecting only the default login page
An attacker may switch to XML-RPC, a commerce endpoint, or a custom form. Compare your route inventory with the control’s documented coverage and test each path.
Running overlapping controls blindly
A CDN, server rule, and two plugins can count failures differently and produce confusing or excessively long lockouts. Keep one clearly defined primary throttle at the earliest practical layer, then add application controls only when their scope is understood.
Assuming a plugin removes all attack cost
Plugin code still runs in PHP. If attacks consume CPU, memory, or database connections, move the first line of defense to the edge or server and ask your host about upstream protection.
The Bottom Line
Use the earliest reliable control—CDN/WAF or server first, WordPress plugin when necessary—cover every authentication route, choose a measured threshold, test recovery, and reinforce the limit with unique passwords, administrator 2FA, and passkeys.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
