Limit Attempts Pro adds access rules, detailed records, statistics, and network controls to WordPress login and form protection. Set the failed-attempt threshold and block duration, then select how different usernames and addresses are handled.

Thresholds, blocks, and access lists

Choose the total number of failed attempts allowed before blocking an IP address. For a non-existent username, apply the standard block settings, block the IP immediately, or add it to the immediate deny list. IP addresses that exceed the block limit can also be added to the deny list automatically.

Allow or deny IP addresses, ranges, and masks. Country blocking uses a GeoIP database; email addresses and domains can also be allowed or denied. List entries can include a country, IP range, and reason. If an address is on both lists, the deny list takes priority.

Activity records and alerts

The Pro log records the IP address, username, password, hostname, event type, form source, and timestamp. Login statistics and a chart of brute-force attempts are available in the settings area and dashboard widget. Email alerts can be sent for blocked or denylisted users, with controls for notification behavior and customizable email messages.

You can also customize the messages shown after failed logins and for blocked or denylisted users. Administrators can force a visitor to log out from all devices, and the Lost Password Form can check password requirements.

Forms, CAPTCHA, and network settings

Hide login, registration, and lost-password forms from blocked or denylisted IP addresses. The plugin's CAPTCHA can be used on default forms, and the plugin is compatible with Captcha Pro, Captcha Plus, and reCaptcha. Contact Form integration includes settings for the email sending interval and the number of emails allowed in each interval.

With the Htaccess plugin, the deny list can be synchronized with .htaccess, an option intended to reduce database load. Multisite network settings let administrators manage the plugin across a network.

Configure the plugin

After installation, open the plugin settings and set the failed-attempt threshold and block duration. Configure the deny and allow lists, add any country, range, email, or domain rules, and set the messages shown to affected users. Enable email alerts if administrators should receive notifications, then review logs and statistics in the settings area or dashboard widget.

For forms, choose the available CAPTCHA and form behavior settings. If the Htaccess plugin is installed, configure list synchronization separately. Multisite administrators can manage network settings across the network. Step-by-step documentation and installation videos are available, and priority support is provided within one business day under the stated support policy.