{"id":118,"date":"2021-04-09T12:29:04","date_gmt":"2021-04-09T12:29:04","guid":{"rendered":"https:\/\/bandittracker.com\/?p=118"},"modified":"2021-04-09T12:29:06","modified_gmt":"2021-04-09T12:29:06","slug":"does-wordfence-limit-login-attempts","status":"publish","type":"post","link":"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/","title":{"rendered":"Does Wordfence Limit Login Attempts? (Read This First!)"},"content":{"rendered":"\n<p>Both the free and premium versions of Wordfence will limit login attempts to help protect your WordPress site. The default options are good for many small websites, but it\u2019s worth reviewing and tweaking them for your own needs.<\/p>\n\n\n\n<p>This article runs through every option and gives tips on the best settings for different scenarios.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_64 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<p class=\"ez-toc-title\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-66114c8371128\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-66114c8371128\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/#How_To_Limit_Login_Attempts_With_Wordfence\" title=\"How To Limit Login Attempts With Wordfence\">How To Limit Login Attempts With Wordfence<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/#Wordfence_Default_Settings_For_Limiting_Login_Attempts\" title=\"Wordfence Default Settings For Limiting Login Attempts\">Wordfence Default Settings For Limiting Login Attempts<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/#Wordfence_Login_Settings_For_One-Person_Websites\" title=\"Wordfence Login Settings For One-Person Websites\">Wordfence Login Settings For One-Person Websites<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/#Wordfence_Login_Settings_For_Websites_With_Several_Admins_Editors_Or_Authors\" title=\"Wordfence Login Settings For Websites With Several Admins, Editors Or Authors\">Wordfence Login Settings For Websites With Several Admins, Editors Or Authors<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/#Wordfence_Login_Settings_For_Membership_Websites\" title=\"Wordfence Login Settings For Membership Websites\">Wordfence Login Settings For Membership Websites<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/#Why_Bother_Blocking_Invalid_Usernames_in_Wordfence\" title=\"Why Bother Blocking Invalid Usernames in Wordfence?\">Why Bother Blocking Invalid Usernames in Wordfence?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/#Blocked_Usernames_in_Wordfence\" title=\"Blocked Usernames in Wordfence\">Blocked Usernames in Wordfence<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/#Alternative_Solutions\" title=\"Alternative Solutions\">Alternative Solutions<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_To_Limit_Login_Attempts_With_Wordfence\"><\/span>How To Limit Login Attempts With Wordfence<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>If you\u2019re new to Wordfence, you may be wondering how to find the settings to limit login attempts. They\u2019re under the Brute Force Protection section. <\/p>\n\n\n\n<p>Open the Firewall page, and you\u2019ll see the link to manage the settings under the Brute Force Protection block.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"862\" height=\"214\" src=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/link_to_brute_force_protection.png\" alt=\"\" class=\"wp-image-119\" srcset=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/link_to_brute_force_protection.png 862w, https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/link_to_brute_force_protection-300x74.png 300w, https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/link_to_brute_force_protection-768x191.png 768w\" sizes=\"(max-width: 862px) 100vw, 862px\" \/><\/figure><\/div>\n\n\n\n<p>This link opens the Firewall Options page and automatically scrolls down to the Brute Force Protection section.<\/p>\n\n\n\n<p>Basic protection is turned on by default so you are protected right out of the box. The only question is whether you want to change the default settings and\/or turn on some extra options.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Wordfence_Default_Settings_For_Limiting_Login_Attempts\"><\/span>Wordfence Default Settings For Limiting Login Attempts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>The default settings in Wordfence are:<\/p>\n\n\n\n<ul><li>20 failed login attempts within 4 hours before locking the IP Address<\/li><li>20 forgot password requests within 4 hours before locking<\/li><li>Block transgressors for four hours<\/li><\/ul>\n\n\n\n<p>You may be thinking that twenty attempts are a lot! And they only get blocked for a few hours? Why not give them ice cream while they cool their heels in the naughty corner!<\/p>\n\n\n\n<p>Maybe you could get a little more aggressive. But before you rush to do so, read our next section. You may be surprised at how often your content editor mistypes her login!<\/p>\n\n\n\n<p>And there are a couple of options that are disabled by default. I usually enable the option to block specific usernames (e.g. \u201cadmin\u201d). I\u2019ll get to this in a later section.<\/p>\n\n\n\n<p>Your type of website will play a big part in how aggressive you should be with these settings. I\u2019ll start with the kind of website that can break out a bigger ban hammer: the one-person websites. And no, I don\u2019t mean sites that get one visitor.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Wordfence_Login_Settings_For_One-Person_Websites\"><\/span>Wordfence Login Settings For One-Person Websites<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>In this scenario, you are the only person logging into WordPress to maintain the site and add content. That doesn\u2019t mean there is only one registered user. You may use multiple logins for different content.<\/p>\n\n\n\n<p>Some administrators get really aggressive here. They change the defaults to something like this:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Failed logins<\/td><td>2 attempts<\/td><\/tr><tr><td>Forgot Password<\/td><td>2 attempts<\/td><\/tr><tr><td>Lockout Time<\/td><td>1 month<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Reasons why you may not want to be so aggressive<\/h3>\n\n\n\n<p>This is my major warning for you: you will have a major headache if you block yourself by mistake. Particularly if you set the lockout time to one month.<\/p>\n\n\n\n<p>First, I advise that you use a password manager with these kinds of settings. Otherwise, fat fingers are gonna get ya!<\/p>\n\n\n\n<p>Secondly, I definitely wouldn\u2019t get this tough if I couldn\u2019t access my WordPress site via FTP to unblock myself. We will have a separate article on this (coming soon).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other login settings for solo websites<\/h3>\n\n\n\n<p>The aggressive administrators turn on the setting to block the IP of users who sign in as some specific usernames e.g. admin. This is because they remove that login from their sites. So, they\u2019re hardly likely to wake up in sleepy mode and mistakenly try to log in as \u201cadmin\u201d.<\/p>\n\n\n\n<p>They also enable the option to block IP addresses that try to log in with a user name that doesn\u2019t exist on your site.<\/p>\n\n\n\n<p>But you should think twice about this if you have more than one website and use different logins on each site (as I recommend you should). If you use a password manager, this isn\u2019t such a worry.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Wordfence_Login_Settings_For_Websites_With_Several_Admins_Editors_Or_Authors\"><\/span>Wordfence Login Settings For Websites With Several Admins, Editors Or Authors<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>You may have one administrator login, but allow several people to publish content through your WordPress installation.<\/p>\n\n\n\n<p>So, here\u2019s the problem. You may have a perfect record for never mistyping your login or password. Go, you! But you are very rare indeed.<\/p>\n\n\n\n<p>If you get aggressive with the settings, you may be constantly dealing with requests to unblock your team to allow them to do their work.<\/p>\n\n\n\n<p>Your decision will probably depend on the other people using the site. If you\u2019re all tech types who use password management tools religiously, then you can set a high barrier.<\/p>\n\n\n\n<p>But what if you have content writers who aren\u2019t super-technical? Here\u2019s a reasonable set of options:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Failed logins<\/td><td>5 attempts<\/td><\/tr><tr><td>Forgot Password<\/td><td>2 attempts<\/td><\/tr><tr><td>Lockout Time<\/td><td>24 hours<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Other login settings for websites with a small number of logins<\/h3>\n\n\n\n<p>Should you enable the option to block IP addresses if they use an invalid username? (i.e. a login that doesn\u2019t exist on your site).<\/p>\n\n\n\n<p>Well, mistyping is a common mistake. You can ask the other users if they use a password management tool. If they look at you blankly, then I wouldn&#8217;t enable this option.<\/p>\n\n\n\n<p>I always like to set a block list of user names. None of my content writers should be trying to log in as \u201cadmin\u201d or \u201ctest\u201d.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Wordfence_Login_Settings_For_Membership_Websites\"><\/span>Wordfence Login Settings For Membership Websites<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Are you using WordPress to run a membership website? Your users may write their passwords on sticky notes and mistype them a dozen times.<\/p>\n\n\n\n<p>I think the default settings are pretty good for this type of site, although 20 attempts are very liberal. I\u2019m a member of several sites that use something like this<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Failed logins<\/td><td>10 attempts<\/td><\/tr><tr><td>Forgot Password<\/td><td>10 attempts<\/td><\/tr><tr><td>Lockout Time<\/td><td>&nbsp;1 hour<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>The \u201cforgot password\u201d setting may still seem high. But the confirmation emails often end up in people\u2019s spam folder. And they assume that there\u2019s some kind of delay and repeatedly click the link. Hopefully, by the time they get to ten attempts, they\u2019ve realized what\u2019s going on.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_Bother_Blocking_Invalid_Usernames_in_Wordfence\"><\/span>Why Bother Blocking Invalid Usernames in Wordfence?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>You may wonder why you\u2019d enable the \u201cinvalid username\u201d option when the standard 20 failed login attempts will block these IP addresses anyway.<\/p>\n\n\n\n<p>The reason to turn on this setting is to protect your website\u2019s performance.<\/p>\n\n\n\n<p>Every login attempt means that your website connects to the WordPress database and runs a query to check that this is a valid user\/password combination. A single request is a tiny use of resources. But if your site is regularly attacked by bots, this option is worth turning on.<\/p>\n\n\n\n<p>Think about it like this. If a bot is sending 20 attempts within a minute (the standard blocking setting), this option will reduce the load by 95%.<\/p>\n\n\n\n<p>You may be wondering how you know if your site is getting overly targeted by bots. We have a companion article on <a href=\"https:\/\/bandittracker.com\/does-wordfence-stop-bots\/\">using Wordfence to block bots<\/a>. There is a specific section that shows you h<a href=\"https:\/\/bandittracker.com\/does-wordfence-stop-bots\/#Use_Wordfence_To_View_Bot_Traffic_Free\">ow to use the Wordfence Live Traffic View<\/a> to review traffic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Blocked_Usernames_in_Wordfence\"><\/span>Blocked Usernames in Wordfence<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Wordfence gives you a box where you can enter a list of usernames that lead to an immediate IP block from a login attempt.<\/p>\n\n\n\n<p>If you use it, don\u2019t forget to enable the option too! It\u2019s disabled by default.<\/p>\n\n\n\n<p>When you review your blocked traffic, you\u2019ll see \u201cadmin\u201d appear very frequently in the attempts. This is because this login comes with the default installation of WordPress.<\/p>\n\n\n\n<p>It\u2019s good practice to add a different administrator login and remove the standard admin username. And now with Wordfence, you can chuck \u201cadmin\u201d into the box and enable the settings.<\/p>\n\n\n\n<p>But it\u2019s not just admin that bots love to use. They also know that many sites may have a \u201ctest\u201d username. Other sites carefully remove the \u201cadmin\u201d login, and create a new login called \u201cadministrator\u201d.<\/p>\n\n\n\n<p>Here is a list of dodgy logins that I use: <em>admin, administrator, root, test, testing, testuser, wplogin, wpwriter<\/em><\/p>\n\n\n\n<p>You can compile your own from reviewing the blocked lists. You may see clever bots that grab your domain name and tack \u201cuser\u201d or \u201clogin\u201d after it. So, you can throw those types of logins into the ban box too.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Alternative_Solutions\"><\/span>Alternative Solutions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>There are other WordPress plugins that will limit login attempts. Some do only this one thing and are more lightweight than WordFence.<\/p>\n\n\n\n<p>You may start with another plugin that exclusively limits logins, and then later install WordFence. You should remove the alternative tool, as it\u2019s a waste of resources to have two tools that provide the same function.<\/p>\n\n\n\n<p>As your website gets to a high volume of traffic, you should review whether a server-level solution is better for performance. A utility like <a href=\"https:\/\/www.fail2ban.org\/wiki\/index.php\/Main_Page\" target=\"_blank\" rel=\"noreferrer noopener\">Fail2Ban<\/a> would be a common choice for this. The set-up requires a little bit more technical expertise than you need with Wordfence.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Both the free and premium versions of Wordfence will limit login attempts to help protect your WordPress site. The default options are good for many small websites, but it\u2019s worth reviewing and tweaking them for your own needs. This article runs through every option and gives tips on the best settings for different scenarios. How &#8230; <a title=\"Does Wordfence Limit Login Attempts? (Read This First!)\" class=\"read-more\" href=\"https:\/\/bandittracker.com\/does-wordfence-limit-login-attempts\/\" aria-label=\"More on Does Wordfence Limit Login Attempts? (Read This First!)\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[3,5],"tags":[],"_links":{"self":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/118"}],"collection":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/comments?post=118"}],"version-history":[{"count":2,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/118\/revisions"}],"predecessor-version":[{"id":121,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/118\/revisions\/121"}],"wp:attachment":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/media?parent=118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/categories?post=118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/tags?post=118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}