Login Limit
Limiting number of login attempts is one of the most powerful protection for any website, as it will stop all brute force login attempts, even if it is done via multiple IPs.
Login Limit works by tracking number of failed login attempts for IP over the period of time, and if the specified period, that number is reached, the login will be disabled.
Settings
Limit Notice
- Show limit message: this option controls display of the login attempts tracking message. It is highly recommended to have this enabled so that user can have some reference as to what is happening with the login attempts.
Login Limiter
- Number of Attempts: How many failed login attempts will be allowed inside the Check Period, before the login is forbidden for the duration of the Limit Period.
- Check Period: this is the period in which the allowed attempts will be tracked. If the value is set to 3600 seconds, that means that at the moment of login attempt failing, plugin will check for number of failed login attempts the IP had in the past hour.
- Limit Period: this is the limit period of the login not being allowed. If the IP reaches specified number of attempts in the specified check period, the login for that IP will be disabled for the specified limit period.
Support login methods
Login limiter works with ANY type of login that passes information through normal login system in WordPress. Even the third party plugins having own forms do that. The issue is displaying messages, because not every form has the same method to display error messages, and plugin supports default WordPress forms, and it also can show notice with some other forms (WooCommerce). Again, if the login form goes through normal WordPress login functions, Login Limit will work, but it might not be able to show message about that.
Banning IP
After the limit gets restricted after the number of attempts is reached for the check period, plugin will log the ‘Limit Login’ event. Now, Ban IPs will monitor this event, and if the same IP has repeatedly failed at login limit, that IP will be banned, and stop from accessing the website. This is how the login limit can quickly stop any form of brute force login attempts.
Limitations
When the login limit number of attempts is reached, the plugin will attempt to hide login form or prevent access to that form. For default WordPress login forms, that is fully supported, and it will show the message about the login limit being in place, and form will not be available.
But, with forms like WooCommerce login form, hiding the form is not currently possible, but the plugin will be improved in the future to cover more forms when it comes to showing notices and hiding login forms.