What Solid Security lockouts mean
If you are trying to figure out how to fix Solid Security lockouts, the first step is understanding what triggered them.
Solid Security, formerly iThemes Security, blocks access when it detects suspicious behavior, repeated failed logins, or settings that make a site appear under attack.
These lockouts are protective, but they can also block legitimate users, including administrators.
The fastest path to recovery depends on whether you are locked out of the dashboard, the login page, or the entire site.
Common reasons Solid Security locks users out
Solid Security uses several features that can restrict access.
Identifying the cause helps you choose the safest fix and avoid disabling the wrong setting.
- Too many failed login attempts from one IP address or username.
- Brute force protection temporarily blocks repeated login requests.
- 404 or file change detection flags unusual activity on the server.
- Ban lists or IP restrictions prevent specific addresses from connecting.
- Strong password or reCAPTCHA rules can stop certain logins from completing.
- Database or plugin conflicts can make the lockout appear more severe than it is.
How to fix Solid Security lockouts when you can still access WordPress
If you can reach the WordPress admin area, recovery is straightforward.
Start by checking the plugin settings instead of making broad changes.
Review the lockout and ban settings
Open Solid Security and look for settings related to login protection, ban enforcement, and lockout thresholds.
Reduce overly aggressive limits if users are being blocked after only one or two mistakes.
Clear your own IP from the banned list
If your office, home, or VPN address was blocked, remove it from the ban list.
Solid Security may store this in its user interface or in a security log depending on the version and configuration.
Temporarily disable the offending protection rule
When you are unsure which feature caused the lockout, disable only the relevant module.
Common examples include brute force protection, local brute force protection, or login security rules.
Re-enable the protection after verifying normal access.
Check for multisite or role-based restrictions
On WordPress Multisite installations, network-level settings may lock out administrators even when site-level settings look normal.
Confirm whether the restriction is applied globally or only to a single site.
How to fix Solid Security lockouts when you cannot log in
If the admin login page is blocked, you will need to bypass the plugin temporarily.
The safest method is to access the site through SFTP, SSH, or your hosting control panel.
Rename the plugin folder
Use SFTP or the file manager in your hosting dashboard to rename the Solid Security plugin folder.
WordPress will deactivate the plugin automatically when it can no longer find the files.
- Go to wp-content/plugins.
- Locate the Solid Security folder.
- Rename it to something like solid-security-disabled.
- Reload the WordPress login page and try signing in again.
Once you regain access, restore the folder name and review the settings before reactivating the plugin.
Use WP-CLI if available
If your host supports WP-CLI, you can deactivate the plugin from the command line.
This is often faster than editing files manually and is useful on production sites with strict permissions.
- Run the command to list active plugins.
- Deactivate Solid Security.
- Log in to WordPress.
- Adjust the lockout settings before re-enabling the plugin.
Restore a trusted IP address
If only your address is blocked, add it to the allowlist through database tools or the plugin’s stored settings, depending on your setup.
Hosting providers often show the current server IP and client IP in network logs, which helps if your address changes frequently.
How to confirm the lockout source
Solid Security logs can reveal whether the lockout came from brute force attempts, a banned IP, or another security rule.
Check the activity log, notification emails, and any security event summaries the plugin provides.
Look for these patterns:
- Repeated failures from one username usually indicate a login threshold issue.
- Access denied immediately can point to an IP ban or firewall rule.
- Intermittent blocking may be caused by a CDN, proxy, or security plugin interaction.
- Lockouts after updates often suggest a configuration change or a compatibility issue.
Fixes for conflicts that look like lockouts
Not every access problem is a true lockout.
Sometimes another plugin, theme, or server rule mimics Solid Security behavior.
Check caching and security layers
Cloudflare, Sucuri, ModSecurity, and host-level firewalls can interfere with login attempts.
If Solid Security is working alongside one of these services, compare their logs to determine which system blocked the request.
Disable other security plugins temporarily
Running multiple security plugins can create overlapping rules.
Test with only one security layer active at a time so you can isolate the source of the block.
Verify browser and cookie behavior
WordPress login depends on cookies and session handling.
Clear browser cookies, disable private browsing extensions, and test in a different browser if the login form loads but never completes.
How to prevent future Solid Security lockouts
Once access is restored, tune the plugin so it protects the site without blocking legitimate users.
Prevention is usually better than repeated emergency fixes.
- Set a reasonable limit for failed login attempts.
- Use strong passwords and unique usernames.
- Whitelist known administrator IP addresses when your connection is stable.
- Avoid stacking multiple login protection tools.
- Test updates in staging before changing security settings on production.
- Monitor lockout emails so you can react before users are fully blocked.
For remote teams, consider using a password manager and a documented admin recovery process.
If staff members travel or use dynamic IP addresses, keep an alternate recovery method available.
Best practices for WordPress administrators
Administrators can reduce recovery time by preparing before a lockout happens.
Store hosting credentials securely, keep SFTP or SSH access available, and make sure at least one trusted person can manage the security plugin.
It also helps to keep a recent backup and a staging copy of the site.
If a new rule causes unexpected lockouts, you can test the fix on staging before applying it live.
When to contact your host or developer
If you still cannot regain access after deactivating the plugin, the problem may be deeper than Solid Security.
Contact your web host if server firewalls, permissions, or malware scanning are blocking the login process.
A WordPress developer can also inspect the database, review the security configuration, and confirm whether a custom rule is breaking the site.
For sites handling customer data, especially WooCommerce stores or membership platforms, it is worth escalating quickly.
Extended lockouts can affect sales, support workflows, and administrative tasks.