Not all hackers and hacker attacks are smart or complicated. Sometimes hacking is as simple as taking control over a bunch of computers and setting them up for a brute force attack. There are dozens of types of brute force attacks, some aim to block incoming traffic to your website others try to deny some other functionality of your platform by flooding it with requests. One of the most popular uses of brute force attacks are the ones used to steal password and usernames.
Given the speed and efficiency of modern hacking tools and computing power available, it is not difficult for hackers to continually try different login credentials for your site and eventually find one that works. That’s brute force, keep trying until something works.
Once they’ve discovered your login information the hacker can steal your data, modify it, or even lock you out of your own WordPress platform.
Enter the Limit Login Attempts plugin.
Limit Login Attempts
We love and use the Limit Login Attempts. It hasn’t been updated in a while, but it still works fine on new version of WordPress. Although I image it will only be a matter of time before it becomes unusable due to WordPress updates.
The name of the plugin is self explanatory; what it does is limit the number of sequential login attempts. It limits the number of times you can enter wrong username and password combinations while logging into your WordPress site. Too many failed attempts and you’re locked out. And yes, that includes you, the site owner.
The plugin allows you to customize the number of failed attempts before the user is locked.
The default number of failed logins that the plugin allows is 4 within 20 minutes. If the hacker’s login failed 4 times in 20 minutes then they have to wait 24 hours before they can try again. Since there are so many easy targets, the hacker won’t wait; they’ll move on to the next one.
IP tracking
So, you might wonder, how does the plugin “know” who is attempting to login? The plugin records all the different IPs that have tried to login to your website. There are ways for hackers to switch IPs, but as I was saying earlier about there being easy targets, they won’t waste their time.
Also, switching to a different doesn’t change the IP.
Setting Up the Limit Login Attempts Plugin
After you install the plugin, it will immediately start tracking login IPs and blocking failed logins. The change the default behavior you just need to go to the settings of the plugin, change a few numbers and click “Save”
The options menu is a single page where you can set:
- The number of allowed retries
- The length of time for the lockout
- The number of consecutive attempts until lockout reset time increase
- The amount of time the lockout reset increases by
The final setting tackles the number of hours until the retries counter is reset, which, by default is left for 12 hours.
Additional settings include:
- Set whether people can only connect directly or if a proxy connection is allowed
- Set cookies usage on or off as well as choose to log the IPs that have tried to login.
And, that’s basically it, in terms of settings.
Update frequency
Don’t be discouraged by the fact that the last update to the plugin was a while back. The plugin still works well. The functionality is quite basic, so it doesn’t need to be updated frequently. The plugin is still supported and has its own support forum with an active community.
Being concerned about your site’s security is very important these days. Check out the Best Plugins for Securing your WordPress Site
If you have any problems with this plugin please let us know in the comments section and I’ll do my best to help you!