Best practice when limiting login attempts

Introduction to Limiting Login Attempts

Implementing a limit on login attempts is an essential security step for WordPress websites, as it helps protect against brute-force attacks — a common method where attackers repeatedly try different login credentials to gain access. By restricting the number of allowed failed login attempts, website administrators can reduce the risk of unauthorised access. This measure blocks an attacker’s IP address after multiple failed attempts, acting as a deterrent and making brute-force attacks much more difficult to carry out.

Why Limiting Login Attempts is Important

WordPress doesn’t set a default limit on login attempts, leaving the login page vulnerable to brute-force attacks. During these attacks, automated tools can test thousands, or even millions, of login combinations per second to crack a password. Without a login attempt limit, attackers could continue indefinitely, increasing their chances of success. Setting limits on login attempts blocks malicious actors before they exhaust system resources, making it harder for them to gain access.

Plugins for Limiting Login Attempts

Several plugins make it easy to add login attempt limits in WordPress:

1. Limit Login Attempts Reloaded: This popular plugin lets administrators set a maximum number of login attempts for each user and IP address. If the limit is exceeded, it temporarily locks the account and/or blocks the IP address.
2. Login LockDown: This plugin tracks the IP and timestamp of every failed login attempt. When multiple failed attempts are made in a short time from the same IP, it automatically blocks access for that IP, creating an effective barrier against brute-force attacks.
3. Wordfence Security: In addition to login limits, Wordfence offers a range of other security features, such as monitoring login activity and blocking suspicious IPs temporarily or permanently.

Each of these plugins offers customisable settings, enabling administrators to fine-tune the limit on login attempts and set the duration of lockouts based on specific security needs.

Configuring Login Attempt Limits

The following steps outline the configuration process using the Limit Login Attempts Reloaded plugin:

1. Install and Activate the Plugin: From the WordPress dashboard, go to Plugins > Add New, search for “Limit Login Attempts Reloaded,” and click Install Now. Then activate the plugin.
2. Set Lockout Rules: In the plugin’s settings, set a maximum number of login attempts (e.g., three to five) before an IP is temporarily blocked.
3. Define Lockout Duration: Choose how long the lockout should last once the maximum attempts have been reached. For instance, the lockout period could be 20 minutes initially and then extend to 24 hours if repeated attempts continue from the same IP.
4. Enable Notifications: Most plugins offer email notifications when an IP or user is locked out. This feature helps administrators stay informed of potential unauthorised access attempts.

Advanced Settings and Customisation

Many plugins include advanced options to further enhance login security:

1. IP Whitelisting: Trusted IPs (e.g., those used by admins or regular users) can be whitelisted to prevent accidental lockouts.
2. Custom Error Messages: Displaying vague error messages (such as “Access Denied”) instead of revealing specific details about failed logins can limit the information available to attackers.
3. Reset Lockout Counters: Some plugins allow the lockout counter to reset after a certain time without failed login attempts, giving users a fresh start if they forgot their password.
4. Limit Username Visibility: Disabling options that display valid usernames through the login form can further reduce the chance of an attacker finding valid login credentials.

Additional Tips for Enhancing Login Security

1. Change the Default Login URL: WordPress login pages are typically located at /wp-admin or /wp-login.php. Customising the login URL (e.g., /myloginpage) makes it more challenging for attackers to locate. Plugins like WPS Hide Login can help change the login URL easily.
2. Enable CAPTCHA on the Login Page: CAPTCHA tools (such as Google reCAPTCHA) can prevent bots from accessing the login page, reducing the number of unauthorised attempts. Plugins like Google Captcha (reCAPTCHA) by BestWebSoft offer simple integrations for adding CAPTCHA.
3. Require Two-Factor Authentication (2FA): 2FA adds an extra layer of security by requiring users to enter a code sent to their phone or email in addition to their password, making it significantly more difficult for unauthorised users to gain access.
4. Monitor Login Logs: Some plugins, like Wordfence and Login LockDown, include login tracking features that help monitor login attempts and identify unusual activity. Reviewing these logs regularly helps identify IPs that repeatedly attempt logins, enabling administrators to take pre-emptive action.

Troubleshooting Common Issues with Login Limits

Setting login limits can sometimes cause minor issues, particularly if genuine users are accidentally locked out. Here’s how to manage common issues:

1. Accidental Lockouts of Real Users: Genuine users may sometimes mistype their passwords, leading to accidental lockouts. To reduce frustration, keep initial lockout durations reasonably short and offer easy password reset options.
2. IP Blocking Issues: In shared IP environments (such as office networks), multiple users could be locked out unintentionally. Using CAPTCHA or 2FA alongside login limits can help prevent these scenarios.
3. High Volume of Lockout Notifications: On sites with numerous login attempts, email notifications can become overwhelming. Adjust notification settings or consider using a security dashboard to view login data directly in the WordPress dashboard.

Advanced Tips for Optimising Login Limits

1. Ban Persistent Offenders Permanently: For IP addresses that repeatedly exceed login limits, consider a permanent or extended ban. Most plugins allow this setting, blocking IPs that frequently reach the maximum limit.
2. Limit Login Attempts on API Access: If the site uses REST API or XML-RPC for remote access, securing these endpoints is essential. Many attacks target the XML-RPC feature, which can be disabled with plugins like Disable XML-RPC Pingback if unused.
3. Enable Rate Limiting at the Server Level: Some hosting providers offer server-level rate limiting, which restricts the number of requests an IP can make over time. This adds extra protection against repeated login attempts and can be implemented using server-based tools such as Fail2ban or ModSecurity.

Final Thoughts
Limiting login attempts is a straightforward yet effective way to improve WordPress security. By restricting failed attempts, blocking IPs with suspicious activity, and combining these measures with options like CAPTCHA and two-factor authentication, you can significantly strengthen your website’s defences.