Plugin categories

Create a Website with AI
Limit Login Attempts Reloaded

Limit Login Attempts Reloaded

Block excessive login attempts and protect your site against brute force attacks. Simple, yet powerful tools to improve site performance.

4.9

Rating summary

1339

Reviews

2M

Active installations

Limit Login Attempts Reloaded
Limit Login Attempts Reloaded
Limit Login Attempts Reloaded
Limit Login Attempts Reloaded
+1

Overview

Compatibility

Customer support & learning resources

Changelog

Main benefits

Restricts login attempts

Protects custom login pages

IP and username denylist

Email lockout notifications

XMLRPC gateway protection

About this plugin

Categories: Security
Version: 2.26.11
Last updated: 22-06-2024
WordPress version: 3.0
Tested up to: 6.5.5
PHP version required: false
Languages: Catalan, Chinese (China) [+63]
Learning resources: View resources

Overview

Limit Login Attempts Reloaded is a powerful WordPress plugin designed to enhance website security by mitigating brute force attacks. It achieves this by limiting the number of login attempts from a specific IP address or username, extending protection to standard, XMLRPC, Woocommerce, and custom login pages. With over 2.5 million active users, this plugin addresses all essential login security needs. The free version includes features such as configurable lockout timings, lockout email notifications, and protection for various login gateways. The premium version further offers enhanced performance optimization, IP intelligence, country-based login blocking, and synchronized lockout data across multiple domains. It also provides premium support and detailed IP activity logs, making it an indispensable tool for safeguarding your WordPress site against unauthorized access.

Enhanced Security

  • Limits the number of retry attempts when logging in per each IP.
  • Automatically prevents further attempts from a particular IP address and/or username after a predetermined limit is surpassed.
  • Includes IP intelligence to detect, counter, and deny malicious login attempts.
  • Provides XMLRPC, Woocommerce, and custom login page protection.

Performance Optimization

  • Offloads the burden of excessive failed logins from your server to protect server resources.
  • Improves speed and efficiency of your website during an attack.
  • Neutralizes failed login attempts in the cloud.

Comprehensive Logging and Notifications

  • Informs the user about the remaining retries or lockout time on the login page.
  • Sends lockout email notifications to the admin.
  • Provides logs of all denied attempts and lockouts.
  • Stores successful logins in the cloud including IP info, city, state, and lat/long.

Advanced Customization and Compatibility

  • Allows configurable lockout timings.
  • Supports IP & Username Safelist/Denylist.
  • Compatible with Sucuri, Wordfence, and Ultimate Member.
  • Supports multi-site compatibility with extra MU settings and GDPR compliance.

Features list

Feature

Free version

Premium version

Limit Login Attempts

Restrict the number of login attempts to prevent brute force attacks.

Configurable Lockout Timings

Set custom lockout durations after failed login attempts.

GDPR Compliance

Ensure data protection and privacy in accordance with GDPR regulations.

WordPress Login Page Protect (Includes WooCommerce & XMLRPC)

Secure the WordPress login page, including WooCommerce and XMLRPC endpoints.

Safelist/Denylist (Supports IP Ranges)

Manage access by allowing or blocking specific IP addresses or ranges.

Lockouts Log

Keep a record of all lockout events for security auditing.

Configurable Email Notifications On Lockouts

Receive email alerts when lockouts occur.

Trusted IP Origins

Designate trusted IP addresses to bypass security restrictions.

Includes 10 domains

Allows management of up to 10 domains.

Performance Optimizer

Optimizes performance for up to 1M requests per month, with 100k requests per domain.

Add more requests as needed

Option to increase the number of requests beyond the initial limit.

Resell and package to clients

Enables reselling and packaging services to clients.

Easily add or remove domains

Simplifies the process of adding or removing domains.

Agency Dashboard

Provides a centralized dashboard for agencies.

Global denylist Protection via Active Cloud

Offers real-time global denylist protection.

Advanced Implementation Support

Includes support for advanced implementation needs.

Auto-add malicious IPs to your denylist

Automatically adds malicious IPs to your denylist.

Premium Support

Provides access to premium support services.

Pricing

Free

$0 / Free

Plan includes

Limit Login Attempts
Configurable Lockout Timings
GDPR Compliance
WordPress Login Page Protect (Includes WooCommerce & XMLRPC)
Safelist/Denylist (Supports IP Ranges)
Lockouts Log
Configurable Email Notifications On Lockouts
Trusted IP Origins
Buy Now

Agency

$45 / Monthly

Plan includes

Includes 10 domains
Performance Optimizer
Add more requests as needed
Resell and package to clients
Easily add or remove domains
Agency Dashboard
Global denylist Protection via Active Cloud
Advanced Implementation Support
Buy Now

In some cases companies have different prices based on various components like a location. As a result the prices displayed here can differ from the ones you see on their websites.

See all pricing options

Rating and reviews

4.9

Rating summary

1339

Reviews

2M

Active installations

5
4
3
2
1

User sentiment analysis

Users praise the WordPress plugin for its ease of use, reliability, and effectiveness in blocking hacker attempts and providing an additional layer of security. They appreciate its straightforward functionality, smooth operation, and the convenience of receiving email alerts for failed login attempts. Many find it essential for any WordPress site and commend it for protecting multiple sites efficiently. However, some users note drawbacks, such as the plugin only limiting login attempts per IP address rather than in total, which allows intruders to change IPs and continue attempts. Occasionally, updates cause functionality issues, such as PHP errors. Overall, the plugin is highly recommended despite minor inconveniences, confirming its utility in enhancing security.
palgate

palgate

01 Feb, 2025

easy to use , worth it
Rob168

Rob168

31 Jan, 2025

This plugin was great and I used it on site I built. But now it is pushing for logs to be stored in their cloud. I will be deleting the plugin for all sites. Not renewing the subscriptions and looking for an alternative that doesnt push my data through their servers.
housesitters

housesitters

31 Jan, 2025

I’ve found Limit Login Attempts to be a useful tool, especially for tracking high numbers of failed login attempts by bots. The notification system provides valuable insight into potential security threats, helping me stay informed about unusual activity on my site. However, the Country Access Rules feature is a bit confusing. The instructions suggest adding an “Allow Only” rule for my country to block all others, but when I switch it to “Deny,” it still displays my allowed country, which makes it unclear whether it’s functioning as intended. Some clearer documentation or interface adjustments would improve the usability of this feature. Overall, it’s a great plugin for enhancing login security, but the country restriction settings could be more intuitive.
tudor117

tudor117

31 Jan, 2025

Does what it says on the box excellent!
Fabrizio Van Marciano

Fabrizio Van Marciano

29 Jan, 2025

Can’t say enough good things about this plugin. I’ve been using it for such a long time now, it is, in my opinion the first line of defense for keeping your site secure. Use it with other security measures for your site and sleep better at night.

FAQ

What do I do if all users get blocked?

How do I know if I’m under attack?

How can I tell that the premium plugin is working?

Could these failed login attempts be fake?

What happens if my site exceeds the request limits in the plan?

What URLs are being attacked and protected?

Why is LLAR more popular than other brute-force protection plugins?

What to do when an admin gets blocked?

What settings should I use in the plugin?

Can I share the safelist/denylist throughout all of my sites?