/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Limit Login Attempts

Limit Login Attempts

By Automattic

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Limit Login Attempts Review - In-Depth Analysis

Limit the number of login attempts for each IP address to enhance security. Fully customizable settings are available.

Performance Overview

WPS Score

7.15/10

User Rating

4.6/5 (based on 202+ reviews)

Active Installations

300,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

5.87 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

Limit the number of login attempts possible both through normal login as well as using auth cookies.

By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease.

Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.

Features include limiting the number of retry attempts when logging in, fully customizable settings, and the ability to inform users about remaining retries or lockout time on the login page. The plugin also offers optional logging and email notifications.

Comparing to Alternatives

Limit Login Attempts is a lightweight, no-frills brute force protection tool, but the category is crowded with actively maintained options that offer more robust security and ongoing updates.

Top alternatives

Strengths

Simple, lightweight approach with no bloat
Straightforward setup that just works for basic brute force protection
Trusted name recognition from Automattic
Long track record with many users reporting it stops repeated hacking attempts

Weaknesses

Appears to lack active maintenance, with users noting infrequent updates
Known unpatched vulnerability exists in current versions
Missing modern features like notification customization or firewall integration found in newer alternatives

User Sentiment Analysis

With 202 ratings and an overall score of 4.6/5, sentiment is strongly positive — 90.6% of reviewers gave 4 or 5 stars. Only 7.9% left 1-2 star ratings, and notably none of the reviews sampled from that low-rating segment included written complaints, suggesting dissatisfaction may stem from silent abandonment or unmet expectations rather than vocal issues.

Positive highlights

"This plugin has thwarted over 100 hacking attempts on my website in the last few months!" — wiitguru
"I absolutely hate bloated plugins, so I love this one. It's simple and works as expected." — Guido
"Does what it says on the tin... I like to keep my admin email clean." — doreenhawdon
"Se lo pone más dicícil a los hackers que quieren acceder a tu blog." — inakijm
"We had initial issues and tried again and it is working better." — brightvesseldev

Common complaints

Weaknesses

Two high-severity XSS vulnerabilities have been recorded, one of which reportedly has no known fix
A reviewer explicitly flagged the plugin as not actively maintained
Lack of recent security patching raises risk for sites still running outdated versions

Who Should Use This?

Best for

Users wanting a minimal, no-nonsense brute force login protection tool with a simple setup, and who are comfortable monitoring the plugin's update status themselves.

Not ideal for

Site owners with strict security requirements, agencies managing client sites, or anyone needing assurance of active vulnerability patching — the unresolved high-severity XSS flaw is a real concern for these users.

Pricing & Value

Free version includes

The plugin is entirely free and provides basic login attempt limiting to deter brute force attacks, with straightforward configuration and no upsells or bloat.

Final Verdict

Limit Login Attempts earns genuine goodwill from users who appreciate its simplicity and effectiveness at blocking repeated login attempts. The strong 4.6-star rating and low volume of negative feedback reflect a plugin that has done its core job reliably for years without unnecessary complexity.

However, the presence of an unpatched high-severity XSS vulnerability and user-reported signs of stalled maintenance are serious red flags for a security-focused tool. Given the abundance of actively maintained alternatives — several forked directly from this plugin's legacy — most users, especially those with security-sensitive sites, would be better served switching to a currently supported option.