Login attempt limiter

WordPress accepts an unlimited number of login attempts by default. Nothing stops a script from trying one password after another, all day, from the same address. The login attempt limiter counts failed attempts per IP address and blocks that address once it crosses a threshold you set.

Out of the box it allows 5 failed attempts and then locks the address out for 30 minutes. You can set the threshold anywhere from 1 to 20 attempts, and the lockout anywhere from 5 minutes to 24 hours. A genuine person who mistypes a password twice never notices it exists.

Every failed attempt is also written to Vectro’s security log table with the IP address, the username tried and the time. When a lockout fires and email alerts are on, Vectro emails you the IP address, the number of attempts, the username tried and how long the lockout lasts.

Brute force traffic against wp-login.php is constant and automated. It is not targeted at you personally – scripts sweep IP ranges looking for any WordPress install that answers. An unprotected site commonly sees hundreds to thousands of failed attempts a day, and every one of them costs you a database query, a password hash comparison, and a slice of PHP memory.

Rate limiting changes the arithmetic. A script that gets 5 guesses per half hour instead of thousands per hour is no longer a practical threat, and your server stops burning resources on traffic that was never going to succeed.

Vectro hooks the WordPress authentication flow. Each failed attempt increments a counter for the requesting IP address in a dedicated database table, wp_vectro_lockouts (with your site’s table prefix), which Vectro creates on activation. When the counter reaches your threshold, the row gets a lockout expiry time and further logins from that address are refused until it passes.

The address comes from REMOTE_ADDR. Proxy and CDN headers are ignored unless a developer names a trusted header with the vectro_trusted_proxy_header filter, so a client cannot forge a header to dodge a lockout. On a site behind a proxy or CDN such as Cloudflare, set that filter, otherwise every visitor can appear to come from the proxy’s address. Deactivating Vectro clears every active lockout; the table itself is only removed when you delete the plugin.