Blocks brute-force attacks by locking out IPs after too many failed logins. No database tables, hashed IP storage, and a CIDR whitelist — lean security that just works.
Download Free from WordPress.org ↗Everything you need, nothing you don't.
Automatically block IPs after N failed login attempts.
Never lock out your own IP or office subnet.
IP addresses are SHA-256 hashed — never stored raw.
Optional alert whenever an IP gets blocked.
Up and running in under 5 minutes.
Install from WordPress.org and activate. A Login Limiter menu appears — protection is on by default.
Add your own IP address or subnet to the whitelist so you can never be locked out.
Choose how many failed attempts are allowed, the time window for counting them, and how long a lockout lasts.
Failed logins are tracked automatically. Review currently blocked IPs and unblock any of them with one click.
Add your IP to the whitelist before enabling. If you are already locked out, connect via FTP/SFTP and delete the plugin folder, or remove the ll_attempts option from wp_options via phpMyAdmin.
Yes. It hooks into the core WordPress authenticate filter and wp_login_failed action, which WooCommerce and every theme/plugin login form use.
No raw IPs are kept. Each IP is hashed with SHA-256 and your site's secret salt before storage, and only a partially-masked IP is shown in the admin for reference.
None. Attempt records live compactly in the WordPress options table and expire automatically via a scheduled cleanup task.