How to limit login attempts in WordPress

Why it matters

GuessingWeak or reused passwords fall to lists of common ones within hours.

Credential stuffingLeaked email and password pairs from other sites, tried against yours.

LoadA guessing run can take a small server down on its own, long before it finds a password.

Limits per address blunt this, but large runs come from thousands of addresses. Pair a limit with strong passwords, two-factor login for administrators and, where your visitors allow it, a country restriction on the login page.

Check your site

The public check does not test this, because trying passwords on a site is the attack itself.

On your own site, a few wrong passwords in a row should start getting refused. If you can keep guessing at full speed, nothing limits it.

Fix it

nginx

In the http block (often nginx.conf):

limit_req_zone $binary_remote_addr zone=wplogin:10m rate=6r/m;

In the site's server block, copy your existing PHP handling into a dedicated location:

location = /wp-login.php {
    limit_req zone=wplogin burst=4 nodelay;
    limit_req_status 429;
    # the same lines as your normal PHP block, for example:
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass unix:/run/php-fpm/www.sock;
}

Catch: behind a CDN or proxy, $binary_remote_addr is the proxy's address, so every visitor shares one limit; set up the real_ip module first. And this does not cover xmlrpc.php, which can carry hundreds of guesses in one request; block it as well.

plugins

Catch: they run inside WordPress. Each refused attempt still boots PHP and reads the database, so they stop the guessing but not the load. And if the site is ever taken over, the attacker can switch them off.

Questions

Can I lock myself out?

With an address-based limit, only for the length of the window; it heals on its own. Keep a second way in, such as a different network, when you set up a country or address restriction.

Is two-factor login enough instead?

Two-factor login stops a guessed password from being used, which matters most. It does not stop the guessing traffic itself, so the load remains.

What limit should I use?

A person mistypes a few times; a script tries thousands. Around 6 to 10 attempts per 10 minutes per address leaves room for people and stops scripts.

More guides

POST/xmlrpc.php200 OKDisable XML-RPC GET/wp-admin/open to allRestrict wp-admin by IP

Last reviewed 2026-10-08