Descrição

Limit the number of login attempts that possible through the normal login as well as XMLRPC, Woocommerce and custom login pages.
WordPress by default allows unlimited login attempts. This allows passwords to be cracked via brute-force relatively easily.
Limit Login Attempts Reloaded blocks an Internet address from making further attempts after a specified limit on retries has been reached, making a brute-force attack difficult or impossible.

Features:

Limit the number of retry attempts when logging in (per each IP). This is fully customizable.
Informs the user about the remaining retries or lockout time on the login page.
Optional logging and optional email notification.
It is possible to whitelist/blacklist IPs and Usernames.
Sucuri Website Firewall compatibility.
XMLRPC gateway protection.
Woocommerce login page protection.
Multi-site compatibility with extra MU settings.
GDPR compliant. With this feature turned on, all logged IPs get obfuscated (md5-hashed).
Custom IP origins support (Cloudflare, Sucuri, etc.)

Upgrading from the old Limit Login Attempts plugin

Go to the Plugins section in your site’s backend.
Remove the Limit Login Attempts plugin.
Install the Limit Login Attempts Reloaded plugin.

All your settings will be kept in tact!

Many languages are currently supported in Limit Login Attempts Reloaded plugin but we welcome any additional ones.
Help us bring Limit Login Attempts Reloaded to even more cultures.

Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish

Plugin uses standard actions and filters only.

Based on the original code from Limit Login Attemps plugin by Johan Eenfeldt.

Ecrãs

Loginscreen after a failed login with remaining retries
Lockout loginscreen
Administration interface in WordPress 5.2.1

Avaliações

grafikIfotoIwebIdesign 3 de Agosto, 2020

Great security Plugin to stop password hacking bots to grab your website. One time I forgot to install it and the worpdress page was hacked. Even new pages get found in only a few days and the bots start their work immediatly. Install this plugin to prevent your page!!!

Scott Markham 3 de Agosto, 2020

A must have, to strength website security.

stuartblackpool 2 de Agosto, 2020

Great plugin, does just what it says.

NinjaDoll_ 1 de Agosto, 2020

Can't do without this plugin for WordPress!

rfulleman 31 de Julho, 2020

Works great. I don't have a website that's worth getting into, but that sure doesn't stop people from trying. Limit Login Attempts Reloaded is on the job.

mtcozzola 30 de Julho, 2020

I always forget about this plug-in until I get an email telling me about a rash of log-in attempts it has thwarted. I'm so grateful that these folks have made my life safer -- especially since I don't have a staff or team helping maintain my site. Thank you!

Ler todas as 328 avaliações

Contribuidores e programadores

“Limit Login Attempts Reloaded” é software de código aberto. As seguintes pessoas contribuíram para este plugin:

WPChef

“Limit Login Attempts Reloaded” foi traduzido para 20 locales. Obrigado aos tradutores pelas suas contribuições.

Traduza o “Limit Login Attempts Reloaded” para o seu idioma.

Interessado no desenvolvimento?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Registo de alterações

2.15.1

Refactoring.

2.15.0

Reset password feature has been removed as unwanted.
Small refactoring.

2.14.0

BuddyPress login error compatibility implemented.
UltimateMember compatibility implemented.
A PHP warning fixed.

2.13.0

Fixed incompatibility with PHP < 5.6.
Settings page layout refactored.

2.12.3

The feedback message is shown for admins only now, and it can also be closed even if the site has issues with AJAX.

2.12.2

Fixed the feedback message not being shown, again.

2.12.1

Fixed the feedback message not being shown.

2.12.0

Small refactoring.
get_message() – fixed error notices.
This is the first time we are asking you for a feedback.

2.11.0

Blacklisted usernames can’t be registered anymore.

2.10.1

Fixed: GDPR compliance option could not be selected on the multisite installations.

2.10.0

Debug information has been added for better support.

2.9.0

Trusted IP origins option has been added.

2.8.1

Extra lockout options are back.

2.8.0

The plugin doesn’t trust any IP addresses other than _SERVER[“REMOTE_ADDR”] anymore. Trusting other IP origins make protection useless b/c they can be easily faked. This new version provides a way of secure IP unlocking for those sites that use a reverse proxy coupled with misconfigurated servers that populate _SERVER[“REMOTE_ADDR”] with wrong IPs which leads to mass blocking of users.

2.7.4

The lockout alerts can be sent to a configurable email address now.

2.7.3

Settings page is moved back to “Settings”.

2.7.2

Settings are moved to a separate page.
Fixed: login error message. https://wordpress.org/support/topic/how-to-change-login-error-message/

2.7.1

A security issue inherited from the ancestor plugin Limit Login Attempts has been fixed.

2.7.0

GDPR compliance implemented.
Fixed: ip_in_range() loop $ip overrides itself causing invalid results.
https://wordpress.org/support/topic/ip_in_range-loop-ip-overrides-itself-causing-invalid-results/
Fixed: the plugin was locking out the same IP address multiple times, each with a different port.
https://wordpress.org/support/topic/same-ip-different-port/

2.6.3

Added support of Sucuri Website Firewall.

2.6.2

Fixed the issue with backslashes in usernames.

2.6.1

Plugin returns the 403 Forbidden header after the limit of login attempts via XMLRPC is reached.
Added support of IP ranges in white/black lists.
Lockouts now can be released selectively.
Fixed the issue with encoding of special symbols in email notifications.

2.5.0

Added Multi-site Compatibility and additional MU settings. https://wordpress.org/support/topic/multisite-compatibility-47/

2.4.0

Usernames and IP addresses can be white-listed and black-listed now. https://wordpress.org/support/topic/banning-specific-usernames/ https://wordpress.org/support/topic/good-831/
The lockouts log has been inversed. https://wordpress.org/support/topic/inverse-log/

2.3.0

IP addresses can be white-listed now. https://wordpress.org/support/topic/legal-user/
A “Gateway” column is added to the lockouts log. It shows what endpoint an attacker was blocked from. https://wordpress.org/support/topic/xmlrpc-7/
The “Undefined index: client_type” error is fixed. https://wordpress.org/support/topic/php-notice-when-updating-settings-page/

2.2.0

Removed the “Handle cookie login” setting as they are now obsolete.
Added bruteforce protection against Woocommerce login page attacks. https://wordpress.org/support/topic/how-to-integrate-with-woocommerce-2/
Added bruteforce protection against XMLRPC attacks. https://wordpress.org/support/topic/xmlrpc-7/

2.1.0

The site connection settings are now applied automatically and therefore have been removed from the admin interface.
Now compatible with PHP 5.2 to support some older WP installations.

2.0.0

fixed PHP Warning: Illegal offset type in isset or empty https://wordpress.org/support/topic/limit-login-attempts-generating-php-errors
fixed the deprecated functions issue
https://wordpress.org/support/topic/using-deprecated-function
Fixed error with function arguments: https://wordpress.org/support/topic/warning-missing-argument-2-5
added time stamp to unsuccessful tries on the plugin configuration page.
fixed .po translation files issue.
code refactoring and optimization.

WordPress.org

Portugal

Really locks your WP entrance door! great Job

Very Useful

Safety first

Great program

Works, so I don’t have to.

Hugely helpful and Glitch-free