Slowing down failed logins
Each failure waits longer than the last, and ten failures lock the account out. What the two settings change, and how to release someone early.
- Beginner
- 5 min read
- Applies to 2.0
How it behaves out of the box
Every failed sign-in makes the next attempt wait longer:
| Failure | Wait before the next attempt |
|---|---|
| 1st | 5 seconds |
| 2nd | 15 seconds |
| 3rd | 30 seconds |
| 4th | 1 minute |
| 5th | 5 minutes |
| 6th | 15 minutes |
| 7th and after | 1 hour |
At the 10th failure the account is locked out for 1 hour. A successful sign-in at any point clears the counter completely.
Two counters, not one
Failures are counted twice over, and the two answer different questions.
By account, and per sign-in method — so someone failing at the password form does not lock themselves out of a magic link. This is the counter the settings below control.
By IP address, across every account and method. This one exists because the first cannot see password spraying: an attacker trying a single common password against a thousand different names never reaches any one account's threshold. They do reach the address threshold, which is deliberately looser than the account one — an office, a school or a household shares a single address, and a morning of mistyping must not lock the building out.
Both counters apply to the plain WordPress sign-in form as well, not only to the
plugin's own — a sign-in posted to wp-login.php is counted like any other.
The two settings
User Access → Security. The fields appear when the mode card is set to Custom.
The Custom mode fields: login attempts, lockout duration and progressive lockouts.
- Login attempts — how many failures before the long lockout. Default 10.
- Lockout duration — how long that lockout lasts, in minutes. Default 60.
- Progressive lockouts — on by default. Turned off, the rising scale disappears and every failure waits the lockout duration you set. That is a blunt instrument: one typo then costs the full duration. If you turn progression off, set a short duration to go with it.
The default lockout is 60 minutes, and raising it a long way is worth thinking about rather than doing by reflex.
A lockout follows the name someone typed, not the person typing it. Ten wrong passwords is a few seconds of work, so a long lockout is a weapon that can be turned against the account that owns the name — every administrator in turn, if that is the goal.
It also buys very little. The rising scale above already stands at an hour between attempts from the seventh failure, so moving from a day to an hour takes an attacker from roughly ten attempts a day to roughly thirty. Neither brute-forces anything; the difference is entirely in how long a locked-out member waits.
The screen shows these defaults before you have ever saved, and they are the values actually being applied. Changing them takes effect on the next attempt — there is nothing to flush.
Releasing someone early
There is no "unlock" button on the Security tab. A lockout ends by itself when its time is up, and a successful sign-in clears the counter — so the quickest route for a locked-out member is usually a password reset, which signs them in and wipes the count.
What this is not
This is not IP blocking. A lockout follows the identifier someone is trying, not their address, and it never adds anything to the blocked list. Nothing in the plugin blocks an address automatically; that list is yours to fill in. See Blocking and allowing addresses.
Coming from version 1.x? These three fields were saved and then ignored: the plugin applied 10 attempts and 24 hours whatever you typed, and the screen even showed 5 and 15 as though those were in force. Since 2.0 they are read. Open the Security tab after updating and check the values are what you meant — a site that had typed 5 attempts will now genuinely lock out at 5.
Something missing or out of date? Tell support.