Does WordPress limit login attempts on its own?
WordPress accepts another password guess on /wp-login.php for as long as the form is up. There is no built-in retry cap and no timed lockout. A script can keep posting usernames and passwords.
Those hits are usually automated, not a person at a keyboard. A correct guess signs them in as that user. A wrong guess still uses PHP and the database. On shared hosting, a noisy login page adds load for your site and for other accounts on the same IP.
A limit cuts the tries short. It does not replace a strong password or a second factor. Two-factor authentication still asks for a code after the password.
Which way should you limit them?
Use one limiter. Limit Login Attempts Reloaded counts failed tries and then locks that address. If Wordfence or Solid Security already locks logins, keep that lockout and do not add a second plugin. Two lockouts fight, and a real user can stay blocked after the first timer ends.
| Method | What it stops | How you know |
|---|---|---|
| Limit Login Attempts Reloaded | Failed tries, then a timed lockout for that address. | A private window shows a lockout notice, and the log lists the IP. |
| Lockout already in Wordfence or Solid Security | The same failed tries, inside that plugin. | Its own log records the block. Do not add a second limiter. |
| IP allowlist in .htaccess | Every visitor except the addresses you name. | Your IP sees the form. A phone on mobile data gets 403. |
Stay with the row you already run. The steps below are for Limit Login Attempts Reloaded. The allowlist is the later section, for a site that will not add a plugin.
How do you turn on Limit Login Attempts Reloaded?
Stay logged in on this browser. Stop when a private window shows a lockout notice instead of the form, and the plugin log lists the IP you just used.
- Open Plugins, then Add New. Search for Limit Login Attempts Reloaded. Click Install Now, then Activate. A Limit Login Attempts item in the left menu means it is on.
- Open that menu, then Settings. Set Allowed retries to 4 and Minutes lockout to 20 if those fields are not already those values. Save.
- Leave this browser signed in. Open a private window and go to /wp-login.php. Type the real username and a wrong password five times.
- The form should be replaced by a lockout notice. In the original window, open the plugin log. Your test IP and the username should be listed. That row means the limit is working.
If the fifth try still shows the password form, the save did not stick or another plugin handled the login. Reload the settings screen, confirm 4 and 20 are still there, and test again.
What retry count and lockout time should you use?
Four failed tries, then 20 minutes, is enough for a mistyped password and too short for a script that wants thousands of guesses. If the plugin screen already shows 4 and 20, leave them and run the private-window test.
A longer lockout, such as 60 minutes, is fine on a site only you use. It is harsh on a shop where customers log in, because one office IP can block the whole office. Raise retries toward 6 only if real users are locking themselves out. Do not set the cap near 50. That is close to no cap.
The wait after a lockout is the Minutes lockout value you saved, not a WordPress core timer. At 20, that address can try again after 20 minutes. An administrator can also clear that row in the plugin log.
Concurrent logins are a different setting. They mean two sessions for one user at the same time. The retry cap counts failed passwords. It does not limit how many people may stay signed in.
How do you get back in after a lockout?
Wait out the timer if you can. With Minutes lockout set to 20, that is a 20-minute wait. Do not ask someone to share a password so you can slip in from their account.
If nobody can sign in, turn the plugin off from the files. In the hosting file manager, or over FTP, open wp-content/plugins. Rename limit-login-attempts-reloaded to limit-login-attempts-reloaded-off.
Reload /wp-login.php. The form should load. Log in, rename the folder back, then clear your IP in the log or add it to the plugin allow list.
Email support@webji.services if the site is on WebJi® and the file manager is new to you. The inbox is staffed 24/7 in Hindi and English, and the first reply is usually under 60 minutes. The office phone is not the support line.
A lockout is not a password reset. Use Lost your password on the login form only after the form is visible again.
Can you limit login attempts without a plugin?
Yes, with an allowlist, not a retry counter. Only the addresses you name can open wp-login.php. Everyone else gets 403 Forbidden. That stops scripts. It also stops you when your home IP changes.
In the site root .htaccess, above the WordPress block, add a Files rule for wp-login.php. Inside it, one line: Require ip, then your public IP. Use 203.0.113.10 only as the shape of the line, and replace it. Save the file.
From that IP the login form loads. From a phone on mobile data the same URL returns 403 Forbidden. If the form vanishes for you as well, delete that Files block in the file manager. The form should come back.
A rule on wp-login.php does not stop password guesses posted to xmlrpc.php. Disabling XML-RPC is the separate check, unless the WordPress app or Jetpack still needs that file.
Hiding the default login path is a different job from counting tries. Changing the login URL makes /wp-login.php return 404. Keep the retry cap after that. Anyone who learns the new address can still guess passwords.
Sites on WebJi® WordPress hosting still share an IP with other accounts. The plan does not add this cap for you. You still save four retries and 20 minutes, then pass the private-window test.
Frequently Asked Questions
How do I limit login attempts in WordPress?
Install Limit Login Attempts Reloaded, set four retries and a 20-minute lockout, and save. In a private window, a fifth wrong password should replace the form with a lockout notice. The plugin log should list that IP.
How many failed logins should I allow?
Start with four. That covers a mistyped password, and it stops a script that needs hundreds of guesses. Move toward six only if real users on one office IP are locking each other out.
How long do I wait after a lockout?
You wait the lockout length you saved. With Minutes lockout set to 20, that address can try again after 20 minutes. An administrator can clear the row in the plugin log instead of waiting.
How do I check WordPress login attempts?
Open the Limit Login Attempts log after a failed try. The row shows the IP, the username, and the time. A missing row means the plugin did not record that request.
What if the plugin locks me out?
Wait for the timer, or rename wp-content/plugins/limit-login-attempts-reloaded to limit-login-attempts-reloaded-off in the file manager. The login form should show again. Email support@webji.services if you cannot find the folder. Do not call the office number for support.
Can I limit login attempts without a plugin?
You can allow only your IP to open wp-login.php with a Files rule in .htaccess. Other addresses get 403. That is not a retry counter, and a new IP locks you out until you edit the file.