Nothing is ever safe, even when it comes to your blog that happens to be on the self-hosted WordPress platform. Before you can be able to write a post for a blog, whether it happens to be on Blogger or WordPress, you must login first. It is quite easier to protect you Blogger blog from unknown logins because, it only requires you to have your email logged into your phone or PC.
On the other hand, WordPress does not need you to have your email account logged in before you can log in to your WordPress dashboard. You just need a username and a password to login to your WordPress dashboard. In this recent times, we have seen most blogs that happen to be on the self-hosted WordPress platform, leave a link for outsiders to register as an author on their blog and write for them.
This is nice but harmful in some way. Few days ago, I received an email from Jetpack, telling me that my site was down. I checked it and it was true. This cause of it was due to too many login attempts on my WordPress site. So, I went on to my hosting provider, and I solved it by unblocking my IP.
This made me realise that I needed to limit the login attempts on my blog, so I decided to install Limit Login Attempts plugin on this site. With Limit Login Attempts plugin, you limit the number of login attempts possible both through normal login as well as using auth cookies.
By default WordPress allows unlimited login attempts either through the login page or by sending special cookies. This allows passwords (or hashes) to be brute-force cracked with relative ease. Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible.
Features of Limit Login Attempts plugin
- Limit the number of retry attempts when logging in (for each IP). Fully customizable.
- Limit the number of attempts to log in using auth cookies in same way.
- Informs user about remaining retries or lockout time on login page.
- Optional logging, optional email notification.
- Handles server behind reverse proxy.
- It is possible to whitelist IPs using a filter. But you probably shouldn’t.
Download Limit Login Attempts here. Head over to Plugins > Add New > Upload. On your file manager, locate and select the plugin, install and activate the plugin. Immediately after activating the plugin, head on Settings > Limit Login Attempts. Now, customize it the way you like, but if you don’t have any idea on how to do that, use the default settings for it.