Limit password reset attempts in WooCommerce – attempt count limit not working

Hi everyone,

I’m trying to implement a limit on password reset attempts in WooCommerce – specifically, to restrict the number of reset requests to 3 per hour per user (login + IP).

I successfully shortened the password reset link expiration time to 1 hour with this code:

add_filter( 'password_reset_expiration', function( $expiration ) {
    return HOUR_IN_SECONDS;
} );

This works as expected- the reset link expires after 1 hour. The problem:

I also want to limit the number of password reset attempts via WooCommerce’s /my-account/lost-password/ page. I used this code hooking into wc_process_password_lost:

add_action( 'wc_process_password_lost', function() {
	if ( empty( $_POST['user_login'] ) ) {
		return;
	}

	$login = sanitize_user( $_POST['user_login'] );
	$ip = $_SERVER['REMOTE_ADDR'];
	$key = 'ag_wc_reset_' . md5( strtolower( $login ) . '_' . $ip );

	$attempts = (int) get_transient( $key );

	if ( $attempts >= 3 ) {
		wc_add_notice( __( 'Too many password reset attempts. Please try again in an hour.', 'woocommerce' ), 'error' );
		wp_redirect( wc_lostpassword_url() );
		exit;
	}

	set_transient( $key, $attempts + 1, HOUR_IN_SECONDS );
}, 5 );

However, this code does not stop the password reset email from being sent after 3 (or more) attempts. The error notice is not shown and the transient counter does not seem to work properly. Environment:

• WordPress version: 6.5.x
• WooCommerce version: 9.0.2
• Custom plugin with the above code
• Theme: Hostinger AI(child theme)
• No other password reset or security plugins active

What works:

• Password reset link expiration (1 hour)
• Password reset emails are sent normally

What doesn’t work:

• Limiting the number of reset attempts (transient counter doesn’t persist)
• WooCommerce error notice (wc_add_notice) does not display

Question:

How can I properly limit the number of password reset attempts per hour in WooCommerce?

Is wc_process_password_lost the correct hook? Or should I use a different hook or approach to block excessive reset requests?

Thanks in advance for your help!

Best regards,
Adam

The page I need help with: [log in to see the link]