{"id":609,"date":"2026-06-29T11:26:58","date_gmt":"2026-06-29T11:26:58","guid":{"rendered":"https:\/\/brutefort.com\/blog\/how-to-limit-login-attempts-wordpress\/"},"modified":"2026-07-15T13:48:09","modified_gmt":"2026-07-15T13:48:09","slug":"how-to-limit-login-attempts-wordpress","status":"publish","type":"post","link":"https:\/\/brutefort.com\/blog\/how-to-limit-login-attempts-wordpress\/","title":{"rendered":"How to Limit Login Attempts in WordPress (Step by Step)"},"content":{"rendered":"\n
\"WordPress
Photo by Pixabay from Pexels<\/figcaption><\/figure>\n\n\n\n

A bot can hammer your WordPress login page with thousands of username and password combinations, and WordPress won’t push back once. There’s no built-in limit \u2014 every attempt just goes through.<\/p>\n\n\n\n

That’s not something you’re missing in your settings. Rate limiting was simply never built into WordPress core, which is exactly why brute force attacks remain one of the most common ways WordPress sites get compromised.<\/p>\n\n\n\n

Adding a login attempt limit closes that gap and turns an unlimited attack surface into a dead end. This guide shows exactly how to set it up with BruteFort, plus the thresholds worth using for your site’s risk level.<\/p>\n\n\n\n

Quick Answer:<\/strong> Install BruteFort, go to Settings \u2192 Rate Limit Settings<\/strong>, and set Max Allowed Attempts<\/strong> to 5 and Time Period<\/strong> to 30 minutes \u2014 the defaults that work for most sites. Click Save<\/strong> and the limit is active immediately, no code required.<\/p>\n\n\n\n

What Login Attempt Limiting Actually Does<\/h2>\n\n\n\n

A login attempt limit \u2014 also called rate limiting \u2014 watches how many failed login attempts come from a single IP address within a defined time window. Once the threshold is crossed, that IP is locked out from the login page for a set period.<\/p>\n\n\n\n

The effect on a brute force attack is immediate. A bot that could try hundreds of passwords per minute is suddenly limited to 5 attempts every 30 minutes. At that rate, cycling through even a modest credential list would take years. Most attack bots move on to easier targets the moment they hit a rate limit.<\/p>\n\n\n\n

Rate limiting also protects against credential stuffing attacks \u2014 where real leaked username\/password pairs from data breaches are tried against your login. Even targeted attempts using real credentials are slowed to the point of being impractical.<\/p>\n\n\n\n

How to Set Up Login Attempt Limiting with BruteFort<\/h2>\n\n\n\n

BruteFort is a focused WordPress brute force protection plugin that handles rate limiting, login lockout, custom login URL, and IP management from a single settings panel. Install it from your WordPress dashboard under Plugins \u2192 Add New<\/strong> and search for BruteFort, then activate it.<\/p>\n\n\n\n

Once active, go to BruteFort \u2192 Settings \u2192 Rate Limit Settings<\/strong>. You’ll see three fields to configure:<\/p>\n\n\n\n

  • Max Allowed Attempts<\/strong> \u2014 the number of failed logins allowed before lockout triggers. The default is 5, which is appropriate for most sites.<\/li>
  • Time Period<\/strong> \u2014 the rolling window in minutes during which those attempts are counted. Default is 30 minutes.<\/li>
  • Custom Error Message<\/strong> \u2014 the message shown to a locked-out IP. You can use the {{locked_out_until}}<\/code> variable to insert the exact time the lockout expires.<\/li><\/ul>\n\n\n\n
    \"BruteFort<\/figure>\n\n\n\n

    Click Save<\/strong> and rate limiting is active immediately. No code changes, no server configuration.<\/p>\n\n\n\n

    \n