Protect Login

Out of the box, WordPress will happily let anyone try to log in as often as they like. Type the wrong password a thousand times and it just shrugs and shows you the form again – which is exactly what someone running a brute-force script is counting on. Protect Login closes that door. It started life as a fork of Johan Eenfeldt‘s original Limit Login Attempts, a plugin a lot of us leaned on for years, and grew from there.

It slows brute-force attacks to a crawl

Protect Login watches failed logins per IP address. After a handful of wrong attempts that visitor has to wait before trying again, and if they keep guessing the wait grows. So a script built to try thousands of passwords ends up sitting on its hands.

You decide who gets in, and who doesn’t

Protect Login keeps a visible list of every address that’s currently locked out, right in the settings, and lets you release any of them with a single click. You can also keep an allowlist of addresses that skip the checks entirely (your office, your VPN’s exit node) and a blocklist of addresses that are turned away immediately.

One login list, shared across all your sites

If you look after more than one WordPress site – an agency, or just a small pile of your own projects — someone hammering one of them is often about to try the rest. Protect Login can link your sites together over its own Remote API: pick one site as the host, point the others at it with a URL and a key, and the block-, allow- and lockout-lists stay in sync across the lot. Block an address once and it’s blocked everywhere.

And a few more things

• Gets the real client IP right when your site sits behind a reverse proxy or CDN — direct and proxy modes
• Speaks IPv6, not only IPv4
• Works on Multisite, applying settings and lists across the network.
• Ships WP-CLI commands, so you can manage addresses and settings straight from the terminal.
• Lets developers set everything in code via filters — and locks the matching field in the UI, so nobody ends up fighting their own filter.
• Can enforce a minimum password strength for new passwords