An unprotected login page can be tried thousands of times a day by automated scripts guessing passwords, and even when none of those guesses succeed, the sheer volume can slow your site down or fill your logs with noise that hides a genuine problem when one occurs. Limiting login attempts and blocking repeat offenders closes that off without affecting anyone logging in normally.
Login attempt limiting & brute force protection
Repeated login guessing limited and blocked, without adding friction to normal logins.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Admin access to configure the relevant plugin or setting
- Confirmation of how strict you want the limiting to be
- Any known legitimate users who log in from shared or variable IP addresses, so they aren’t accidentally blocked
This or something else?
| You want repeated failed login attempts limited or blocked automatically | This fix covers it |
| You want two-factor authentication instead of, or alongside, this | Two-factor authentication setup, a complementary layer |
| Legitimate users are being locked out too often | Worth describing specifically — likely a threshold or shared-IP issue we can tune |
| You want a full firewall, not just login-specific limiting | Firewall (WAF) plugin configuration, a broader layer |
What we do
- Configure attempt limiting with thresholds appropriate to your site’s traffic
- Set an appropriate lockout duration that deters automation without over-blocking
- Account for shared or variable IP addresses among your known legitimate users
- Test the limiting against a simulated repeated-attempt scenario
- Confirm normal login still works without friction for legitimate use
- Document the configuration for future adjustment
What is included
- Login attempt limiting configured and tested
- Thresholds tuned to reduce false lockouts of legitimate users
- Confirmation normal login remains unaffected
- A written note on the configuration chosen
Not included
- Two-factor authentication, a separate, complementary fix
- A full web application firewall, a broader layer of protection
- Ongoing adjustment as your traffic patterns change
- Unblocking a specific user locked out after this fix — a quick follow-up if it happens
Questions about this fix
Will this ever accidentally lock out a real customer or team member?
It's possible if someone genuinely mistypes their password several times in a row, which is why we tune the threshold to be strict enough to deter bots without being so tight it punishes an honest mistake.
Does this stop every kind of automated attack?
It significantly reduces the volume of basic password-guessing attempts, though a sophisticated attacker distributing attempts across many IP addresses can partially work around simple rate limiting.
How is this different from two-factor authentication?
This limits how many login attempts are even allowed; 2FA means a correct password alone still isn't enough to get in — they solve different parts of the same problem and work well together.
Will legitimate users notice any difference when logging in?
No, normal login behaviour is unaffected — the limiting only activates after a number of failed attempts in a short window, which shouldn't happen during ordinary use.
What if I'm already using a security plugin with this built in?
We can review and tune the existing configuration rather than adding a redundant second layer, if your current plugin already covers this reasonably well.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.