WordPress has no built-in protection against brute force attacks. Every failed login attempt goes through full authentication — checking the database, verifying the hash, returning a response. Automated bots exploit this by trying thousands of username/password combinations per hour.
Without a protection layer, WordPress will process every single request. The fix is a login protection plugin that limits attempts and locks out repeat offenders.
What Brute Force Protection Actually Does
- Count consecutive failed attempts from a specific IP address
- Lock that IP out after a configurable threshold (e.g. 5 attempts)
- Log the lockout: IP, attempted username, timestamp, duration
- Send an admin email alert on each lockout
- Release the lockout after a defined period (e.g. 30 minutes)
Most site owners assume their host provides brute force protection at the server level. Some do — many don't. A plugin-level solution works regardless of what your hosting stack handles.
What to Look For in a Free Login Protection Plugin
| Feature | Why it matters |
|---|---|
| Configurable attempt limit | You set the threshold that triggers a lockout |
| IP lockout with adjustable duration | Temporary blocks stop bots without permanent bans |
| Lockout log in wp-admin | See who is targeting your site and when |
| Admin email alerts | Know about attacks without checking daily |
| Two-factor authentication | Even if a password is guessed, 2FA blocks access |
| No cloud API required | Protection works even when external services are down |
NaveenCodes Login Guard
NaveenCodes Login Guard is free on WordPress.org and covers the complete protection workflow: configurable attempt limits, IP lockouts, full admin lockout log, email alerts, optional 2FA via email OTP, and manual IP unblock. No external API calls — everything runs on your server.
How to Install and Configure It
- Go to Plugins → Add New in WordPress admin
- Search for Login Guard NaveenCodes
- Install and activate
- Navigate to Login Guard in the admin menu
- Set your attempt limit and lockout duration
- Enable email alerts and optionally enable 2FA
- Save — protection is active immediately
FAQ
Does WordPress block brute force attacks by default?
No. WordPress has no built-in limit on failed login attempts. Every guess goes through to the database. A plugin is required.
Will this lock out real users too?
Briefly, if they mistype their password more than the configured limit. The lockout is temporary, and the admin can unblock any IP manually from the dashboard.
Is 2FA necessary if I already have attempt limits?
Attempt limits stop automated attacks. 2FA protects against compromised passwords from data breaches — a different threat vector. Both together give comprehensive coverage.
Protect your login. For free.
Attempt limits, IP lockouts, admin log, email alerts, optional 2FA. No external API. No subscription. Free forever.