Every WordPress site receives automated login attempts, every day. They guess common usernames and passwords until one works.
Limit login attempts
After a few failures, lock the address out for a while, and longer each time. Bots give up, real users barely notice.
Do not reveal usernames
WordPress says whether the username exists. A generic error message gives attackers nothing.
Avoid “admin”
Use a personal username for administrators.
Strong passwords and two-factor
A password manager and two-factor authentication for administrators close the door for good.
Watch the log
A log of lockouts shows how often your site is targeted, and helps you spot a problem.
Lockly limits login attempts on wp-login, WooCommerce My account and XML-RPC. See the demo and how to customize the login page.
Frequently asked questions
How many attempts should I allow?
Around 5 in 30 minutes suits real users.
Can I lock myself out?
Yes, so add your own IP address to the allowed list.
Does a security plugin slow my site?
A simple login limiter only runs on login.