Sign-in
Brute Force Protection
Stops password guessing by locking out anyone who gets the password wrong too many times in a row.
What it does
A brute force attack is when a robot tries thousands of passwords, one after another, hoping one works.
Stack Guard counts wrong passwords from each internet address. After a few misses in a short time, that address is locked out for a while and cannot try again until the lockout ends.
An IP address is the number that identifies a visitor's internet connection, a bit like a return address on an envelope.
Why you might want it
Without a limit, a robot can keep guessing forever. With one, it gets a handful of tries and then has to wait, which makes guessing a strong password practically impossible.
Real people rarely get their password wrong five times in a few minutes, so it seldom gets in anyone's way.
Turn it on
- Go to Stack Guard, then the Login tab, and find Brute force.
- Switch on Local Brute Force Protection.
- Check the numbers under Login Attempts. The defaults suit most sites: 5 tries, remembered for 5 minutes, then a 15 minute lockout.
- Click Save Changes.
The settings in plain words
Max Attempts per IP: how many wrong passwords one address gets before it is locked out. Set it to 0 to only record wrong passwords without locking anyone out.
Remember Bad Login (Check Period): how long a wrong password counts against an address. With 5 tries and 5 minutes, someone has to miss 5 times within 5 minutes to be locked out.
Lockout Duration: how long the lockout lasts. If someone keeps guessing after a lockout, they are locked out again.
Lockout message: the text a locked-out visitor sees. Type {time} where you want the time left to appear. Leave it empty to use the standard message.
Extra protection with Pro
Max Attempts per User counts wrong passwords for each username, wherever they come from. This catches attacks spread across many addresses.
Automatically lockout "admin" user locks out any address that tries the username admin, because robots try it first. Only switch this on if no real account on your site is called admin, or that person will be locked out too, even with the right password.
What visitors will see
When someone is close to the limit, the sign-in page warns them how many tries are left.
Once locked out, they see a message saying to try again later, with the time left. When the time is up, they can sign in as normal.
A successful sign-in clears that address's count, so people who get it right on the third try start fresh next time.
If you lock yourself out
The simplest fix is to wait until the lockout ends. You can also sign in from a different connection, for example your phone with Wi-Fi switched off, because the lockout is tied to the address.
To make sure it never happens to you, add your own address to the IP Whitelist on the Firewall tab. Addresses on the whitelist are never counted or locked out.
With Pro, an administrator can clear every lockout at once with Clear Attempts on the Dashboard.
If nobody can get in, add define( 'SMG_SAFE_MODE', true ); to wp-config.php, the settings file in your site's main folder, just above the line that says That's all, stop editing! Sign in, fix the setting, then remove the line again. The Login Guard topic explains this step by step.
Which plan includes it
Lockouts by address and the lockout email are included in every plan, including Free. The email is sent once you switch on Notifications and its IP lockouts alert. Lockouts by username, the "admin" trap and a custom lockout message are part of Pro; on Free, locked-out visitors see the standard message.
How it works, for developers
- Failed sign-ins are recorded on
wp_login_failedin thesmg_login_attemptstable (address, username, time, and when an address or username lockout ends). A successful sign-in clears that address and username. - Lockouts are checked on the
authenticatefilter at priority 30, before WordPress checks the password, so a locked-out robot learns nothing. The remaining tries warning useslogin_errors. - Actions for alerts and logging:
smg_ip_locked_out,smg_user_locked_out,smg_admin_username_blocked. - Allow-listed addresses are never locked out. In safe mode attempts are still recorded but nobody is locked out. Old records are removed by
smg_daily_cleanupafter the window set on the Settings tab. - Settings:
smg_brute_force,smg_brute_force_attempts,smg_brute_force_user_attempts,smg_brute_force_check_period,smg_brute_force_lockout(both stored in minutes),smg_brute_force_lockout_admin,smg_lockout_message.
Quick answers about brute force protection
What does Brute Force Protection do in Stack Guard?
A brute force attack is when a robot tries thousands of passwords, one after another, hoping one works. Stack Guard counts wrong passwords from each internet address. After a few misses in a short time, that address is locked out for a while and cannot try again until the lockout ends. An IP address is the number that identifies a visitor's internet connection, a bit like a return address on an envelope.
Why use brute force protection on a WordPress site?
Without a limit, a robot can keep guessing forever. With one, it gets a handful of tries and then has to wait, which makes guessing a strong password practically impossible. Real people rarely get their password wrong five times in a few minutes, so it seldom gets in anyone's way.
How do I set up brute force protection?
1. Go to Stack Guard, then the Login tab, and find Brute force. 2. Switch on Local Brute Force Protection. 3. Check the numbers under Login Attempts. The defaults suit most sites: 5 tries, remembered for 5 minutes, then a 15 minute lockout. 4. Click Save Changes.
Which Stack Guard plan includes brute force protection?
Lockouts by address and the lockout email are included in every plan, including Free. The email is sent once you switch on Notifications and its IP lockouts alert. Lockouts by username, the "admin" trap and a custom lockout message are part of Pro; on Free, locked-out visitors see the standard message.
More in Sign-in
- Login GuardMoves your sign-in page to an address only you know, so the robots that try passwords on every WordPress site cannot find it.
- Sign-in errors and sessionsStops the sign-in page from telling strangers which usernames exist, signs out sessions left idle, and caps how long "Remember me" keeps someone signed in.
- Two-factor authenticationAdds a second step to signing in: after the password, a code from a phone app or an email. A stolen password alone is no longer enough to get in.
- Magic links for locked-out usersLets a real user who has been locked out ask for a one-time sign-in link by email, instead of waiting for the lockout to end or calling you.
- CAPTCHAAdds a quick "are you human?" check to your sign-in, sign-up, password reset and comment forms, so robots cannot use them.
Not running Stack Guard yet? It is free.
Download Free