Progressive lockouts
Five failures trigger 5 minutes, ten trigger 30 minutes, and twenty or more trigger 24 hours.
Free feature
Login protectionfor wp-admin
Bots hit WordPress login pages constantly. Thousands of attempts per day on some sites. This shuts that down - tracks every attempt, blocks repeat offenders, and keeps a log so you can see what is happening.
What it does
Login protection
Watches your wp-login page. Every failed attempt gets logged with the IP, location, and username they tried. Too many failures from the same IP? Blocked. Default lockouts: 5 fails then 5 minutes, 10 then 30 minutes, 20 or more then 24 hours and an email.
Approximate location
Shows an approximate country for an IP so unusual login traffic is easier to notice.
Escalation email
At 20 or more failures, the repeat-offender lockout also sends an email.
Login-attempt history
See the IP, attempted username, approximate location and time.
Whitelist trusted IPs
Add your office IP so you do not lock yourself out.
Automatic IP blocking
Bans happen automatically. You do not sit there watching logs.
Why it is there
What happens without it
If you have ever looked at server logs, you have seen it - constant login attempts from random IPs. They are not typing these by hand. Automated scripts run through password lists. And they do not stop.
They take the dashboard
They get in, change your password, and now it is their site.
They export the database
With admin access they can export user emails, order history, whatever you stored.
They drop a backdoor
First thing they do is leave a way back in. Even after you change the password.
They wreck your rankings
Hidden spam links. Google notices. Rankings tank.
You need something watching that login page. This blocks repeat offenders and records login attempts automatically. Pair it with free administrator two-factor login.
Pair with two-factor login.
Use Bearmor Security on your WordPress
Install the free plugin from WordPress.org. Every feature is free, with no paid plan to unlock.