By default, WordPress allows unlimited login guesses on your admin screen. Automated botnets take advantage of this by running rapid-fire password scripts until they break in or crash your server with traffic spikes. KO Limit Login Attempts lets you limit login attempts in WordPress automatically by blocking malicious IP addresses after 3 failed tries.
You can protect your admin login screens from automated brute-force attacks without setting up heavy security suites. This tool is part of my collection of free WordPress plugins built to strengthen site security with fast, lightweight code.
- Version: 1.0.0
- Requires WP: 6.0+
- PHP: 7.4+
- Frontend Assets: 0 KB
- License: GPLv2
Why I Built KO Limit Login Attempts
Every WordPress site gets targeted by automated login bots searching for weak administrator passwords. Because standard WordPress doesn’t restrict password retries, an attacker can test thousands of password combinations against your login form every hour.
Heavy security plugins try to solve this by loading massive scanning suites that slow down your database and lock out legitimate users with false alarms.
I built this micro-plugin to provide clean, reliable login protection. It tracks failed login tries using fast temporary records, locks out suspicious IPs after 3 consecutive mistakes, and gives you a 1-click button to whitelist your own IP so you never get locked out.
How to Stop Brute-Force Password Attacks
Here is how this tool lets you limit login attempts in WordPress to protect your site:
- Automatic 3-Strike Lockout: Temporarily blocks any IP address that fails 3 consecutive login attempts.
- Custom Lockout Timing: Set your preferred lockout duration directly from your dashboard (default is 20 minutes).
- One-Click IP Whitelist: Protect your own connection with a single click so you never accidentally lock yourself out.
- Cloudflare & Proxy Support: Reads real visitor IP headers accurately through Cloudflare and reverse proxies.
- Live Security Logs: View blocked attack totals and manage currently locked IP addresses with an instant unlock button.
- 100% Free & Open Source: Released freely under the GPLv2 license with the full source code on GitHub.
How to Install and Set Up KO Limit Login Attempts
Setting up brute-force login protection takes less than two minutes:
- Download the ZIP: Grab the latest
ko-limit-login-attempts.zipfile using the download button above. - Upload & Activate: Head into Plugins -> Add New Plugin -> Upload Plugin in your dashboard, select the zip file, and click Activate.
- Configure Your Lockout Settings: Open up KO Plugins -> Limit Login from your sidebar, click + Whitelist My IP, set your lockout duration, and click Save Settings.
Once active, any attacker failing 3 login attempts will be blocked immediately with a clear countdown timer.
Frequently Asked Questions About KO Limit Login Attempts
What happens when an IP address hits 3 failed login attempts?
WordPress locks out that specific IP address for 20 minutes (or your chosen duration). The user sees a clear error notice displaying the remaining lockout minutes.
Can I whitelist my own IP address so I never get locked out?
Yes. You can click the “+ Whitelist My IP” button right on the settings dashboard to permanently exempt your IP address from lockout checks.
Does this plugin work if my site uses Cloudflare?
Yes. The plugin specifically checks Cloudflare and proxy headers so it tracks real visitor IP addresses rather than Cloudflare server addresses.
Can I manually unlock an IP address before the timer expires?
Yes. The Locked IPs table displays all currently blocked IPs with an instant 1-click Unlock action.
Can I use this plugin on client websites?
Yes. KO Limit Login Attempts is licensed under GPLv2, which means you can install and use it freely on unlimited personal, business, or client websites.