Limit Attempts Pro expands WordPress login and form protection with broader access rules, detailed activity records, and multisite controls. Set the total number of failed attempts allowed before an IP address is blocked, along with the block duration.

Choose how attempts are handled

For non-existent usernames, apply the standard block settings, block the IP immediately, or add it to the immediate deny list. IP addresses that exceed the block limit can also be added to the deny list automatically.

Allow or deny IP addresses, ranges, and masks. Country blocking uses a GeoIP database; email addresses and domains can also be allowed or denied. List entries can include a country, IP range, and reason. If an address appears on both lists, the deny list takes priority.

Apply rules to forms

Hide the login, registration, and lost-password forms from blocked or denylisted IP addresses. Use the plugin's CAPTCHA on default forms, or connect Captcha Pro, Captcha Plus, or reCaptcha. The plugin also works with Contact Form, with settings for the email sending interval and the number of emails allowed in each interval.

Review activity and notifications

The Pro log records the IP address, username, password, hostname, event type, form source, and timestamp. Login statistics and a chart of brute-force attempts are available in the settings area and a dashboard widget. Email alerts can be sent for blocked and denylisted users, and you can customize notification emails and messages shown for failed logins, blocked users, and denylisted users.

Manage a website or network

Multisite network settings let administrators manage the plugin across a network. An administrator can force users to log out from all devices; Pro also includes a multiple-action option and a Logout All users button. It can check password requirements on the WordPress Lost Password Form.

If the Htaccess plugin is installed, its synchronization option can copy the deny list to .htaccess, a setting intended to reduce database load. Configure this separately from the plugin's other rules.

Configure and monitor

Install and activate the plugin, then open its settings. Set the failed-attempt threshold and block duration, configure access lists and any country, email, or domain rules, and select messages and notification behavior. Review logs and statistics as activity accumulates. Step-by-step documentation and installation videos are available, and priority support is provided within one business day under the stated support policy.