Limit Login Attempts Reloaded

Overview

Limit Login Attempts Reloaded, now titled Limit Login Attempts Security on its listing, is a login-protection plugin credited to WPChef. It was listed on WordPress.org in August 2016 and reported 1+ million active installations in November 2026; the developer states that it is trusted by 2 million websites.^[17]

WordPress by default allows unlimited login attempts, which lets bots guess usernames and passwords repeatedly. The plugin limits failed attempts by IP address and username, locks out suspicious activity with adjustable lockout durations, protects wp-login.php and XML-RPC, and adds built-in two-factor authentication.^[17] The developer lists brute-force attacks, bot logins, credential stuffing, XML-RPC attacks and WooCommerce login abuse among the threats addressed.^[17] Paid cloud options add firewall and further protections.^[17]

Because it focuses on one attack surface, the plugin is lightweight and pairs easily with a broader firewall or scanner. On its own, it does not protect against vulnerable plugins or malware.

Limit Login Attempts Reloaded features

• Failed-login limits by IP and username
• Adjustable lockouts
• wp-login.php and XML-RPC protection
• Two-factor authentication
• WooCommerce login protection
• Optional cloud firewall

Limit Login Attempts Reloaded pricing

Free plugin; premium cloud plans available, see vendor.

Limit Login Attempts Reloaded strengths and limitations

Appears in

• Best WordPress Security Plugins in 2026 #12

Limit Login Attempts Reloaded alternatives and competitors

Alternatives to Limit Login Attempts Reloaded: companies ranked in the same lists.

• WSWordfence Security
• Patchstack
• Sucuri
• Kadence
• UpdraftPlus
• MalCare
• Jetpack VaultPress Backup
• WPMU DEV
• Shield Security
• NNinjaFirewall
• SiteGround
• WP Activity Log