Goal: stop someone working through password guesses against your site.
Steps
- Go to Password Protected → Settings → Brute Force Protection.
- Failed attempts allowed — 5 is a sensible default. Lower is stricter.
- Lockout duration (minutes) — 30 by default.
- Optionally add a CAPTCHA:
- Under Advanced Settings, set CAPTCHA type to Google reCAPTCHA v2
- Get keys from the reCAPTCHA admin console
- Paste in the Site key and Secret key
- Click Save settings.
How lockout behaves
- Tracked per IP address, so one person guessing does not lock out your real visitors.
- While locked out, even the correct password is refused.
- The counter resets on a successful unlock.
- It applies to the plugin’s REST endpoint too, so that cannot be used to get around the limit.
Choosing a limit
| Attempts | Suitable for |
|---|---|
| 3 | High-security, technical audience |
| 5 | Most sites. Tolerates typos. |
| 10 | Non-technical audience, long passwords |
| 0 | Disables the feature — not recommended |
How passwords are stored
Passwords are stored as bcrypt hashes, never as readable text. This means:
- Nobody, including you, can read an existing password back out of the database.
- The admin screens show
••••••••for a password that is set, with an Edit password button to replace it. - A duplicated password cannot inherit the original’s value.
Authentication cookies are signed with an HMAC tied to your site’s secret keys, so they cannot be forged or edited by a visitor.
Login Page Protection (PRO)
You can put the site password in front of wp-login.php, adding an extra layer of security before the WordPress login screen is even accessible. Logout and password reset pages remain reachable.
Additional CAPTCHA Options (PRO)
In addition to Google reCAPTCHA, the PRO version provides support for hCaptcha and Cloudflare Turnstile.