Limit Attempts Pro: Login Rules and Attempt Logs

Limit Attempts Pro includes access rules, activity records, statistics, and multisite settings to the free plugin capabilities. Set how many failed login attempts trigger an IP block and how long the block lasts, then choose how the add-on handles various accounts and forms.

Set block rules and access lists

Add IP addresses, ranges, and masks to allow or deny lists. Country blocking uses a GeoIP database; email addresses and domains can also be allowed or denied. List entries can record a country, IP range, and reason. If an address appears on both lists, the deny list takes priority.

For non-existent usernames, choose the standard block settings, an immediate IP block, or immediate placement on the deny list. Addresses that exceed the block limit can also be added to the deny list automatically. The failed-attempt counter resets after a successful login.

Review activity and notifications

The Pro log records the IP address, username, password, hostname, event type, form source, and timestamp. Login statistics and a chart of brute-force attempts appear in the settings area and a dashboard widget. Email alerts can be sent for blocked or denylisted visitors, with controls for notification behavior and message text. You can also personalize messages shown for failed logins and blocked or denylisted users.

Configure forms and integrations

Login, registration, and lost-password forms can be hidden from blocked or denylisted IP addresses. CAPTCHA settings include the plugin's CAPTCHA for default forms and compatibility with Captcha Pro, Captcha Plus, and reCaptcha. Incorrect CAPTCHA responses can count as failed logins. The Pro edition also checks password requirements on the WordPress Lost Password Form.

Contact Form integration includes settings for the email sending interval and the number of emails allowed per interval. If the Htaccess plugin is installed, its deny-list synchronization can reduce database load. Multisite network settings let administrators manage the plugin across a network. Administrators can also force users to log out from all devices.

Configure the plugin

After installing and activating the plugin, open its settings. Set the failed-attempt threshold and block duration, configure allow and deny lists and any country, range, email, or domain rules, then choose the messages and email alerts. Review logs and statistics in the settings area or dashboard widget. For forms, choose the CAPTCHA and form behavior options. Configure Htaccess synchronization separately if that plugin is installed; multisite administrators can use the network settings.

Step-by-step documentation and installation videos are available. Priority support is provided within one business day under the stated support policy.