How to Limit Login Attempts and Protect Your WordPress Login from Brute-Force Attacks

If your WordPress site has been running for a while, chances are automated bots are already trying to guess your admin password. This is called a brute-force attack: a script tries hundreds or thousands of username and password combinations against your login page until one works, or until it gives up and moves to the next site. Limiting login attempts stops this by locking out anyone (or anything) that fails to log in too many times in a row.

Why this matters

A successful brute-force attack can hand over full control of your website: your content, your customer data, and in some cases your hosting account if the attacker plants malicious code. Beyond the security risk, repeated login attempts also waste server resources, which can slow your site down for real visitors. Setting a login limit closes off one of the most common ways WordPress sites get compromised.

Install a login-limiting plugin

The simplest and most reliable way to do this is with a dedicated plugin. WordPress does not limit login attempts by default.

1. Log in to your WordPress admin dashboard (yoursite.com/wp-admin).
2. In the left menu, go to Plugins, then click Add New Plugin.
3. Search for a reputable login-limiting plugin, such as Limit Login Attempts Reloaded or WPS Limit Login.
4. Click Install Now, then Activate.
5. Open the plugin's settings page (usually found under Settings in the left menu) and set your preferred limits, for example a lockout after 4-5 failed attempts, with a lockout duration of 20 minutes or more.
6. Save your changes.

If your hosting account offers Softaculous, you can also reach the same result by opening Softaculous from your control panel, finding your existing WordPress installation, and installing a security plugin from its plugin browser instead of doing it from wp-admin.

Choose a lockout duration that is long enough to discourage bots but not so long that a genuine mistyped password locks you out of your own site for hours. Most plugins let you whitelist your own IP address if you have a fixed one.

A few extra steps worth taking

• Use a long, unique password for your admin account, not one reused from another site or service.
• If any account on your site is still using the username admin, create a new administrator account with a different username and remove the old one. Bots almost always try admin first.
• Keep WordPress core, your theme, and all plugins updated, since outdated software is a common way attackers get in even after login attempts are limited.
• Consider a plugin that also adds a CAPTCHA or math question to the login form, which stops many bots before they can even submit a guess.

If you ever end up locked out of your own account after making these changes, see How to Reset a Lost WordPress Admin Password for how to regain access.