Let’s be clear that no one likes to use long and complex passwords. The more characters you add, the more secure you make it, the more likely you are to make mistakes when trying to log into apps, service accounts, and your WordPress website. Still, you go through them all as safety is important.
For someone determined to keep their website as secure as possible with long and complex passwords, limiting the number of WordPress login attempts may seem like the last thing you want to do. But as we said before, security is important and forcing a timeout between a certain number of login attempts is a valid security measure..
In this article, we will show you:
Most website owners and administrators realize that they are not the only ones logging into their websites. Everyone, from content creators to search engine optimization experts, needs access to your website backend. But even if you make their workday a little harder on the days when they have trouble remembering login information, they are not the people you set a login restriction on your website.
The people you protect your website with login attempt limitation are hackers with bots and scripts. Among the many techniques, tools, and attack vectors they can use to harm your website, exploit it for their gain, or simply mess with you, hackers can try something called a brute force attack to access your website backend.
When using a brute-force attack to try to access your website backend, a hacker will effectively try combinations of letters, numbers, and characters until they find one that gives them access to the website. They usually don’t do the hacking on their own – they use scripts to try tens of thousands of passwords every second until they find one.. This depends on how strong the password you use, they can take seconds to years to crack your password.
Forcing the hacker to take a break every other attempt won’t make your website inaccessible, but it will make hacking more time-consuming. When trying to crack the password is impractical – very costly in terms of time and resources – the hacker is likely to move on to the next target.. If you have them, they will try a different type of attack. Either way, it’s very unlikely they’ll continue to use brute force to get in.
The easiest way to limit login attempts to WordPress is to use a plugin. This Limit Login Attempts Reloaded plugin It’s a great choice for several reasons – it’s free, has a lot of active installs, and people who use it mostly have nothing bad to say about it. If there is no login attempts limiter feature, you can install it on top of other security plugins you are already using.
After installing and activating the plugin, you can navigate to: Settings > Limit Login Attempts To install the plugin. The first set of options you access is under the Dashboard tab. There, you’ll have access to some lockdown statistics, but more importantly, you’ll be able to blacklist and whitelist certain IPs and usernames..
In the Settings tab, you will be able to choose whether the plugin must be GDPR compliant and whether you want to be notified by email when the crash occurs.
This is where you can set working settings set the number of retries allowed, how long you want the lockout to last, and how long you want to wait before the retries reset.
The last tab contains the debug code, which you should submit to the plugin manufacturer’s support if something goes wrong.
After making and saving all the settings, the plugin will start doing its job. When someone tries to log in using an incorrect password or username, they are notified about the number of attempts remaining..
If they fail to provide a valid username and password for their failed attempts, they will be blocked from retrying for the period you specify.
Limiting login attempts should not be the only measure you take to keep your website secure. Putting security first is something you should do when choosing a web host. This is why it is often better to opt for this premium WordPress theme than download who knows what and use it to customize your website. And only then should you start thinking about plugins that can help you secure your website.
A lot of it is up to you.. For example, knowing how to create, store, and use passwords is almost as essential as knowing how to turn on your computer or smartphone – without this knowledge you can’t do anything online.
Some of the basics of password security include:
After doing all this, you should expect your password to be reasonably well protected against most potential threats. The only thing left to do is be alert to new threats and then take action against them.
let’s hug
It’s never a good idea to let anyone poke around at the backend of your website. We have passwords for that – to help us control access to critical parts of our websites.
But the fact that passwords exist doesn’t stop bad actors from trying to access your website for their own, often nefarious, reason. That’s why you need to help your passwords do their job. You can make them strong, varied, and change them often. However, you can set a limit on login attempts to your WordPress website and send a public message to anyone trying to brute-force your website.
Support our work ❤️
If you enjoyed this article, consider leaving a tip to help us keep publishing great content.
