Built to Stop Brute Force. Nothing More, Nothing Less.
Four focused features that cover every angle of WordPress login security — rate limiting, URL obfuscation, geographic access control, and IP management.
Stop bots cold after too many attempts.
Set a ceiling on login attempts within any time window you choose. Once that ceiling is hit, BruteFort locks the IP out and shows a custom error message — including the exact time they can try again.
If bots can’t find your login, they can’t attack it.
Replace the well-known /wp-login.php path with any secret slug you choose. Bots and scanners target the default URL automatically — change it and you eliminate the majority of attacks before they start.
Lock out entire countries — or lock down to just yours.
The vast majority of brute force traffic originates from a handful of countries. BruteFort’s geo blocking gives you two modes: blacklist specific countries, or whitelist only the regions your users actually come from.
Block specific countries. Everyone else gets through.
Allow only your chosen countries. Maximum lockdown.
Absolute control over who gets through.
Whitelist your own admin IPs so they’re never accidentally locked out. Blacklist repeat offenders permanently. Every rule you set overrides all other protections — this is the final word.
See every hit. Know every threat.
Every failed login attempt is logged in real time — IP address, attempt count, status, and precise timestamp. Refresh on demand, filter by IP or status, and paginate through the full history.
FREE WORDPRESS PLUGIN
Every feature. Zero cost. Install in two minutes.
Rate limiting, custom login URL, geo blocking, IP management, and attack logs — all free, all in one plugin.
Install BruteFort on WordPress.org