Six WordPress tools catch brute-force login attempts, which are automated guesses at usernames and passwords. Wordfence, Solid Security, Jetpack, Limit Login Attempts Reloaded, All-In-One Security, and Sucuri each offer a form of login-guessing protection. They differ in where blocking happens and how much setup is required. Some lock out repeat offenders temporarily, some share attack data across sites, and one works mainly through a paid firewall.
Table of Contents
- How do Wordfence and Solid Security block attackers?
- What does Jetpack do by default?
- Which lean plugins focus on login limits?
- Where does Sucuri fit?
- How should you set lockouts and allowlists?
How do Wordfence and Solid Security block attackers?
Wordfence Security uses Brute Force Protection that locks out an IP address for a set time after a configured number of login failures, according to Wordfence help documentation on lockout counts and time periods. Site owners control the failure count and the lockout window. That makes it a good fit when you want direct control over thresholds.
Solid Security, formerly iThemes Security, pairs local lockouts with Network Brute Force Protection, according to SolidWP help docs. Local lockouts stop repeat guesses from one address. Network protection bans IPs already seen attacking other participating sites, so known offenders never get many tries on your login page.
What does Jetpack do by default?
Jetpack Brute Force Protection is activated by default on Jetpack-connected sites and automatically blocks malicious IPs before they reach the site, according to Jetpack support for Protect. There is no rule to build before protection starts. This default coverage suits owners who want fewer settings to manage.
Continuous attacks still deserve custom thresholds and allowlists. Jetpack reports blocking an average of 5,193 brute-force attacks over a site lifetime, according to Jetpack data on brute-force protection. Treat login attacks as constant background noise, not occasional events.
Which lean plugins focus on login limits?
Limit Login Attempts Reloaded blocks an IP address or username after a set retry limit, according to its WordPress.org listing. It covers normal login, XMLRPC, WooCommerce, and custom login pages. That broad page coverage helps stores and membership sites with more than one entry point.
All-In-One Security, or AIOS, uses configurable login lockdown that limits failed attempts, locks out violators, and sets lockout duration, according to TeamUpdraft. Use it when you want basic lockouts inside a wider hardening plugin. Keep the retry limit low enough to stop guessing but high enough to allow honest typos.
Where does Sucuri fit?
Sucuri catches brute-force logins mainly through its paid cloud firewall rather than the free plugin, according to Sucuri guidance on protecting the WordPress login URL. One common approach is restricting which IPs can reach wp-admin and wp-login.php. That stops many bots before WordPress loads.
This matters because WordPress by default does not limit failed login attempts and has no native two-factor system, according to Sucuri research updated Mar. 5, 2024. Login pages therefore remain open to credential guessing without added protection. Choose firewall restriction when you want access control above the login screen.
How should you set lockouts and allowlists?
Start with a small failure allowance, a meaningful lockout time, and separate treatment for usernames with administrator access. Add your office IP, your developer IP, and trusted service IPs to the allowlist. Review lockout logs after the first week and tighten limits if guessing continues.
For XMLRPC, WooCommerce, or custom login forms, confirm each path is actually guarded after setup. A limiter that protects only the main form leaves other doors open. Retest after theme, checkout, or login-page changes.
