# Limiting login attempts on WordPress using a plugin

> Protect your WordPress login from brute-force attacks by installing a plugin that limits failed login attempts and locks out repeat offenders.

Source: https://helpcenter.ruachost.com/wordpress/guides/limiting-login-attempts-on-wordpress-using-a-plugin/

By default, WordPress allows unlimited login attempts. This makes your site vulnerable to **brute force attacks**, where hackers try multiple password combinations until they gain access. On **ruachost.com**, you can secure your WordPress site by installing a plugin that limits login attempts.

## Why Limit Login Attempts?

- Prevents brute force password guessing.
- Blocks repeated failed logins from the same IP address.
- Enhances overall site security.
- Reduces server load caused by malicious login attempts.

## Steps to Install and Configure Login LockDown Plugin

1. **Log in to WordPress** with an administrator account.
2. In the dashboard, go to **Plugins → Add New**.
3. Search for **Login LockDown**.
4. Click **Install Now**, then **Activate**.
5. In the dashboard, go to **Settings → Login LockDown**.
6. Configure the following options:

   - **Max Login Attempts** → Set the number of allowed retries (e.g., 3).
   - **Retry Time Period** → Define the time window for retries (e.g., 5 minutes).
   - **Lockout Length** → Set how long the IP will be blocked after exceeding attempts (e.g., 1 hour).
   - **Whitelist IPs** → Add trusted IPs that should never be blocked.
7. Click **Update Settings** to save changes.

✅ The plugin will now log failed login attempts and block suspicious IPs automatically.

## Important Notes

- If you use a firewall or security suite, check for overlapping features.
- Always whitelist your own IP to avoid accidental lockouts.
- Combine with other security measures (SSL, strong passwords, 2FA) for maximum protection.