How to limit login attempts in WordPress (and stop botnets too)

A guide for site owners. Updated October 12, 2026.

Out of the box, WordPress lets anyone try as many passwords as they like, as fast as they like. Bots do exactly that, all day, on almost every WordPress site. Limiting login attempts means counting failed logins and making the guesser wait after a few, so guessing a password takes years instead of hours.

It sounds simple. Done badly, it either misses most of the attack or locks out your own customers. Here's what a good setup covers.

1. Cover every login door, not just the login page

WordPress has more than one place that checks a password:

• wp-login.php, the login page everyone knows.
• xmlrpc.php, an older remote-publishing door that bots hit all day. It never shows a page, so protections that only sit on the login page, such as a CAPTCHA, don't cover it. (More on XML-RPC.)
• The WooCommerce My Account login, on stores.
• Application passwords, used by the REST API.

A limit that only watches wp-login.php leaves the others open. Count failures from all of them together.

2. Lock out the guesser, and make each lockout longer

A sensible limit sits well above what a person does and far below what a bot needs: a handful of wrong passwords in a quarter of an hour. Each lockout in the same day should last longer than the one before (minutes, then an hour, then a day), so a patient bot gets almost nothing done.

3. Don't stop at one address: botnets rotate

Serious attacks come from botnets: thousands of hacked computers, each trying a few passwords and moving on. Every address stays under any per-address limit. What gives them away is the target: one account failing again and again from many different addresses.

When that happens, the account should only open on devices that have logged in to it before, for a while. The real owner can still get in from their usual browser, or by resetting their password by email.

4. Get the visitor's real address

If your site sits behind Cloudflare, a load balancer or your host's proxy, every visitor can look like the same address. Then one lockout locks out everyone. Your security plugin has to recognise the proxy, and only believe a forwarded address from a proxy you trust. Headers like X-Forwarded-For can be typed by anyone, so believing them from anywhere lets bots dodge every limit.

5. Leave a way back in for real people

Offices, schools and mobile networks put many people behind one address. Sooner or later a bot on the same Wi-Fi will trigger a lockout that hits a real customer. A good setup:

• lets someone's usual browser in with the right password, even while their network is locked out;
• tells everyone else how long to wait, with a "reset your password" link that works at once;
• lets you unlock someone in one click, and always let in addresses you trust;
• can offer a quick "prove you're human" check (such as Cloudflare Turnstile) to anyone stopped by a limit.

6. Limit password reset emails too

Bots also hammer "Lost your password?", to flood people's inboxes or find out which accounts exist. Limit reset requests per address and per account, and give the same answer whether or not the account exists.

And the basics

Limits slow guessing down; strong, unique passwords and two-factor sign-in for administrators make it hopeless. Use both.

Ropeline does all of this, free

Ropeline is a free plugin on WordPress.org:

• 5 wrong passwords in 15 minutes locks an address out: 15 minutes, then an hour, then a day. It covers wp-login.php, XML-RPC, WooCommerce's My Account login and application passwords.
• Botnet guard: when one account fails 10 times in an hour from 3 or more addresses, it only opens on devices that logged in before, for an hour.
• Cloudflare is recognised automatically, and a load balancer is one click to trust.
• Ways back in for real people, an Unlock box, and an optional Turnstile check.
• A 7-day learning mode first, so you can see what it would stop before it stops anything.
• No account, no ads, and it never contacts Ropeline.

Questions

I locked myself out. What now?

With Ropeline, use "reset your password" on the login page; it lets you in at once. If you can't, add define( 'ROPELINE_OFF', true ); to wp-config.php, or rename the plugin's folder, then remove it once you're back in.

Should I hide or rename the login page instead?

It cuts down the noise from the laziest bots, but it isn't protection: XML-RPC and the other doors still check passwords, and a new address is easy to find. Limit attempts either way.

Does a CAPTCHA on the login page do the same job?

It slows down bots that use the page, and annoys people who log in often. It doesn't cover XML-RPC or application passwords, and it doesn't notice a botnet working through one account.

Running a WooCommerce store? Bots also test stolen cards at checkout: how to spot card testing and stop it.