Login Protection Limit Failed Login Attempts PRO

Most site owners find out their login is under attack when the server slows down or the host sends a warning. Meanwhile, automated scripts have spent days trying username and password combinations on the login page. This plugin puts a limit on those attempts and blocks whoever exceeds it.

The attacks come from places where you have no customers

If you sell in one country or region, your login page has no reason to be open to the rest of the world. Login Protection Limit Failed Login Attempts PRO lets you block by country: you can allow only the countries you serve or ban the ones that attack you most. It also blocks by IP range, hostname, browser or referrer, which helps cut off entire networks at once instead of one address at a time.

How failed-attempt blocking works

When the attempt limit is exceeded, the IP is blocked. Each further failure makes the next lockout longer, and repeat offenders can move to a permanent deny list. The legitimate visitor sees on the login page how many attempts are left and how long the lockout lasts, so they are not left wondering what happened. You can also set different limits for specific IP addresses.

• Email alert as soon as a lockout happens.
• Administrator unlock through an email link or from the dashboard, useful if you lock yourself out while testing rules.
• Captcha compatibility with Google reCAPTCHA and Captcha Plus: the captcha stops simple bots and this plugin stops persistent ones.

A log to decide with data, not by guesswork

The lockout log stores the username tried, role, IP, country and time, and optionally the first three characters of the password attempted. That helps you spot patterns, such as dictionary attacks or the same username repeated. From a log row you can move an IP to the permanent list. There are attack charts, a statistics map by country and a dashboard widget with the ten most blocked IPs.

Your store has a front door too

By default WordPress protects only the standard login page, and in a store the customer account holds orders, addresses and history. The plugin also covers the WooCommerce customer login, not just the administrator one. If you run a store, that is probably the strongest reason to install it.

Weak accounts are still your job

This is what the plugin covers and what you will have to handle another way:

• It solves: attempt limits, blocking by IP, country, range, host, browser or referrer, email alerts, log and charts, WooCommerce login.
• You cover: strong, unique passwords for every user, since the plugin slows the attempts but does not fix a weak password.
• You cover: a captcha, if you want one, because the plugin works well with them but does not include its own.
• You cover: the privacy policy and the retention periods for IPs, which can be configured but have to be decided.

It is not a full firewall or an antimalware tool either: it protects access, and does not scan files or the vulnerabilities of other plugins.

Frequently asked questions about Login Protection Limit Failed Login Attempts PRO

What happens if I lock myself out?

You can unlock the administrator with the link sent by email or from the plugin dashboard.

Does it protect WooCommerce customer logins?

Yes, in addition to the normal WordPress login page.

Does it work with reCAPTCHA?

Yes, it is compatible with Google reCAPTCHA and Captcha Plus, and they can be used together.

What do I do about the personal data it stores?

It stores IP addresses for security purposes and lets you configure their retention and deletion. Adjust it to your privacy policy.

Is country blocking available in every version?

Country blocking is a feature of this PRO version.