Ropeline – Limit Login Attempts & Brute Force Protection

Bots try to break into WordPress sites all day, mostly at the login. Ropeline stands at the door.

Login. Bots guess passwords thousands of times a day. Ropeline locks out an address after 5 wrong passwords in 15 minutes. Each lockout in the same day lasts longer: 15 minutes, then an hour, then a day. It covers wp-login.php, the WooCommerce My Account login, XML-RPC (a second login door that bots use all day) and application passwords.

Botnets spread their guesses over thousands of addresses to stay under limits like that, so Ropeline also watches each account. When one account fails 10 times in an hour from 3 or more addresses, it only opens on devices that have logged in before, for an hour. The real owner can always get in by resetting their password by email.

Password reset emails are limited too, so bots cannot flood anyone’s inbox.

Card-testing alerts for WooCommerce. Card testing is bots trying stolen cards on your checkout, and it shows up as a burst of failed payments. When 10 or more payments fail within 24 hours, Ropeline warns you on its Overview, in the WordPress Dashboard and in a red alert at the top of every admin screen, with what to do next. When 10 fail within an hour, it also emails you (at most once a day), because attacks often start at night. (Stopping the attack itself is part of Ropeline Pro.)

Fake-account check. Bots make fake accounts: throwaway email addresses, web links in their names, one Gmail inbox with the dots moved around, dozens in a few minutes. Ropeline looks through your customer and subscriber accounts and tells you how many look fake, and why. Accounts with orders, posts or approved comments never count, staff accounts are never looked at, and the check deletes nothing. (Deleting them in one click is part of Ropeline Pro.)

Prove you’re human (optional). If a limit ever stops a real person, for example because a bot on the same Wi-Fi caused a lockout, they can pass a quick Cloudflare Turnstile check and carry on at once. Add your free Turnstile keys in Settings to switch it on.

Learning mode. For the first 7 days Ropeline only watches and records what it would have stopped, so you can check it will not get in anyone’s way. Then it starts blocking.

Plain English. The Overview shows every failed login and lockout with its address, an “Always let in” button and a one-click Unlock box. A Dashboard widget sums up the week.

Free, with no limits. Everything above is in this plugin, free, with no trial and no account. It never contacts Ropeline.

Ropeline Pro (optional, paid). A separate add-on from getropeline.com, with a 14-day free trial: leaked-password checks, hidden usernames, card-testing protection for WooCommerce checkout, fake-signup and spam blocking for comments, reviews and contact forms, one-click fake-account cleanup, verified AI-shopper checks, card-skimmer alerts, a weekly report and the Ropeline Network, where sites warn each other about the bots they stop. This plugin works fully without it.

External services

Ropeline connects to one outside service, and only if you switch it on. It never contacts Ropeline itself: getropeline.com only opens in your browser when you click a link or button to it.

getropeline.com, only when you click. The “Try Pro” links open Ropeline Pro’s checkout in your browser and tell it the address of this site’s Ropeline settings (and the plan that fits: Site, or a store plan for your store’s paid orders in the last 30 days), so the page after checkout can send your new key back here. A key sent back is kept only if you click “Save my key”, for Ropeline Pro to use when you install it. “Download Ropeline Pro” sends that key to getropeline.com, which checks it’s in its free trial or paid. Privacy, Terms.

Cloudflare Turnstile (challenges.cloudflare.com), only if you add Turnstile keys in Settings, and only when a visitor stopped by a limit opens the “prove you’re human” page. That page loads Cloudflare’s Turnstile script in the visitor’s browser, and your site sends the one-time token and your secret key to Cloudflare to confirm it. Terms, Turnstile privacy addendum.

Privacy

Ropeline keeps a log of what it stopped and watched, with the visitor’s IP address and, for failed logins, the username tried. The log is deleted after 30 days. Lockout counters expire within a day. When someone logs in, Ropeline sets a cookie (ropeline_device_ followed by the user’s ID) that marks the browser as one they use, so it still works if their account is ever under attack; it holds a timestamp and a signature, nothing else, and lasts a year. Someone who passes the optional “prove you’re human” check gets a ropeline_human cookie with a timestamp and a signature that lasts an hour. Nothing is sent to Ropeline.