WordPress.org

Author: Johan Eenfeldt

Limit the number of login attempts possible both through normal login as well as (WordPress 2.7+) using auth cookies.

By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.

Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.

Features

• Limit the number of retry attempts when logging in (for each IP). Fully customizable
• (WordPress 2.7+) Limit the number of attempts to log in using auth cookies in same way
• Informs user about remaining retries or lockout time on login page
• Optional logging, optional email notification
• Handles server behind reverse proxy

Translations: Bulgarian, Catalan, Czech, German, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish

Plugin uses standard actions and filters only.