Why login limits matter after a WordPress hack
After a WordPress hack, login protection is often one of the first security controls to strengthen.
Limiting login attempts helps slow brute-force attacks, reduce password spraying, and give your site fewer opportunities for automated abuse.
If an attacker already got in once, they may try again with stolen credentials, reused passwords, or bots.
Adding login throttling, lockouts, and related controls can make it much harder for them to regain access while you finish cleanup and recovery.
What login attempt limiting actually does
Login attempt limits track repeated failures from the same account, IP address, or device fingerprint and temporarily block further tries after a threshold is reached.
On a WordPress site, this is usually handled by a security plugin, a web application firewall, or server-level rules.
- Brute-force mitigation: Stops automated guessing of usernames and passwords.
- Password spray defense: Makes broad low-and-slow attack patterns less effective.
- Incident containment: Buys time after a compromise while you reset credentials and review logs.
- Alerting: Surfaces suspicious activity so you can respond faster.
How to limit login attempts after WordPress hack
The safest approach is to combine several layers rather than relying on one setting.
A plugin can enforce lockouts, a firewall can filter malicious traffic, and WordPress account hygiene can remove the attacker’s easiest options.
1. Install a trusted security plugin
Choose a security plugin that supports login throttling, temporary lockouts, and activity logging.
Popular options include Wordfence, iThemes Security, Solid Security, and All In One WP Security, all of which can limit login attempts and record blocked requests.
- Set a low failure threshold for admin accounts.
- Enable temporary lockouts after repeated failures.
- Configure longer lockouts for high-risk roles such as Administrator and Editor.
- Turn on alerts for repeated login failures or unfamiliar locations.
2. Block repeated attempts by IP address
If the attack is coming from a small set of addresses, block them at the plugin, firewall, or server layer.
IP-based blocking is useful after a targeted attack, but it should be combined with account-based controls because attackers often rotate IPs through proxies and botnets.
Use this carefully if your users share public networks, VPNs, or mobile carriers that can change IPs frequently.
In those cases, keep lockout durations short enough to avoid self-inflicted access problems.
3. Add rate limiting at the firewall level
A web application firewall such as Cloudflare, Sucuri, or a managed host firewall can rate-limit login requests before they reach WordPress.
This reduces load on your server and helps block high-volume bot activity at the edge.
- Limit requests to
/wp-login.phpand/wp-admin. - Challenge suspicious traffic with CAPTCHA or JavaScript verification.
- Set higher thresholds for legitimate traffic and lower thresholds for repeated failure patterns.
4. Require multi-factor authentication
Login limits slow attackers down, but multi-factor authentication, or MFA, adds a second barrier that is far more difficult to bypass.
After a hack, MFA should be enabled for all administrative users and, if possible, for editors and site managers too.
Common methods include authenticator apps, hardware security keys, and push-based verification.
Avoid SMS alone when stronger options are available.
5. Reset passwords and remove stale accounts
If an attacker accessed the site, assume credentials may be exposed.
Reset passwords for all privileged users, force logout sessions, and delete any accounts that no longer need access.
- Use unique passwords stored in a password manager.
- Change database credentials if you suspect deeper compromise.
- Review user roles and downgrade unnecessary administrator accounts.
- Remove accounts created during the intrusion.
6. Limit access to wp-login.php where possible
Some site owners reduce exposure by restricting access to the login page through IP allowlists, VPN access, or additional authentication at the server layer.
This is useful for internal sites, client portals, and small teams with predictable access patterns.
For public-facing sites, combine this with CAPTCHA, login throttling, and MFA instead of relying on obscurity alone.
Hiding the login page does not replace proper authentication controls.
Recommended lockout settings after a breach
The right thresholds depend on your traffic and user base, but a conservative setup is a good starting point after a compromise.
The goal is to stop repeated guessing without locking out legitimate users too aggressively.
- Maximum attempts: 3 to 5 failed logins per account or IP address.
- Lockout duration: 15 to 60 minutes for first offenses.
- Escalation: Longer lockouts after multiple repeated lockouts.
- Admin sensitivity: Stricter limits for privileged roles than for subscribers.
Test these settings with a safe test account before applying them sitewide.
If your site has heavy editorial activity or many contributors, adjust the policy so normal workflow is not interrupted.
Signs your login controls are working
Once limits are in place, review security logs and access reports to confirm they are doing their job.
Healthy settings should show blocked attempts, rate-limited requests, and fewer successful attacks rather than a flood of repeated password guesses.
- Repeated failures from the same username are blocked.
- Automated login scripts are delayed or denied.
- Security alerts appear when attack patterns spike.
- Legitimate users can still log in without frequent support tickets.
Common mistakes to avoid
Security changes made after a hack can create new problems if they are too strict or too narrow.
Avoid these common mistakes when learning how to limit login attempts after WordPress hack recovery.
- Relying on one plugin only: Pair plugin limits with firewall and MFA controls.
- Using overly long lockouts: Long bans can block real users, especially on shared networks.
- Ignoring user cleanup: Limiting logins does not remove compromised accounts.
- Skipping logs: Without logs, you cannot tell whether the attack is continuing.
- Leaving default admin usernames: Common usernames make brute-force attacks easier.
Additional hardening steps that support login protection
Login limits work best when combined with broader WordPress security improvements.
These measures reduce the chance that attackers can regain access even if they know your login page exists.
- Update WordPress core, plugins, and themes promptly.
- Remove inactive plugins and themes you do not use.
- Disable file editing in the dashboard.
- Use SSL/TLS everywhere on the site.
- Back up the site regularly and store backups offsite.
- Monitor for unexpected changes to files, users, and settings.
When to bring in a security professional
If the hack involved persistent malware, unknown administrator accounts, or recurring login abuse, a WordPress security specialist can help with forensic review and recovery.
Professional help is especially valuable when you need to identify the entry point, confirm cleanup, or harden server-level protections beyond the WordPress dashboard.
Look for someone who can review access logs, scan for malicious code, validate file integrity, and confirm that lockout rules will not interfere with business-critical users.