Control repeated login and form attempts
Limit Attempts Pro is a WordPress security plugin for limiting failed login attempts and blocking IP addresses for a configurable period. It is designed to help administrators manage brute-force activity and bot logins without modifying code. The Pro edition includes all free features together with expanded rules, logging, statistics, and multisite controls.
Expanded deny and allow rules
Pro lets you add IP ranges and masks to deny or allow lists. You can also block IP addresses by country using a GeoIP database, or allow and deny access by email address or domain. The lists can be managed with a country, IP range, and reason for each entry.
Set the total number of failed attempts allowed before a block is applied. For non-existent usernames, choose whether to use the standard block settings, apply an immediate IP block, or place the address directly on the immediate deny list.
- Add IP ranges and masks to deny or allow lists.
- Block IP addresses by country.
- Allow or deny access by email address or domain.
- Control total failed attempts before blocking.
- Configure handling for non-existent usernames.
- Use lists that record country, IP range, and reason.
Detailed logs, charts, and notifications
The Pro log tab records the IP address, username, password, hostname, event type, form source, and timestamp. Login statistics and a brute-force attempts chart are available in the settings area and dashboard widget, giving administrators a view of activity over time.
The plugin can send email alerts for blocked and denylisted users. Settings include controls for notification behavior and customizable email messages. You can also customize the messages shown for failed logins, blocked users, and denylisted users.
Forms, CAPTCHA, and multisite support
Limit Attempts Pro can hide login, registration, and lost-password forms from blocked or denylisted IP addresses. It can use the plugin’s CAPTCHA on default forms and is compatible with Captcha Pro, Captcha Plus, and reCaptcha. The plugin also supports multisite network settings.
Additional integrations include the Htaccess plugin, which can synchronize the deny list with .htaccess. This option is intended to reduce database load. The plugin is also compatible with Contact Form and provides settings for email sending intervals and the number of emails allowed per interval.
Practical setup workflow
After installation, open the plugin settings and define the failed-attempt threshold and block duration. Configure the deny and allow lists, choose any country, range, email, or domain rules, and set the messages shown to affected users. Enable email alerts if administrators should be notified, then review the logs and statistics from the settings area or dashboard widget.
For forms, select the available CAPTCHA and form behavior options. If the Htaccess plugin is installed, configure its synchronization option separately. Multisite administrators can use the network settings to manage the plugin across the network.
Installation
Install Limit Attempts Pro from the WordPress administration area, activate it, and open its settings. Configure the blocking, notification, list, CAPTCHA, and logging options according to the site’s requirements. Detailed step-by-step documentation and installation videos are available, and priority support is provided within one business day under the stated support policy.
