Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security
by WPChef · Security
Also makes 5 other plugins · 1M+ installs across the portfolio →
Limit login attempts and stop brute force attacks. WordPress security with 2FA, firewall, bot protection, IP blocking, and secure login monitoring.
Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.
Health
B 83/100
no flags
Active installs
1M+
≈1.8M estimated
Momentum
-56%
downloads vs prior 30d
Biggest opportunity: Support resolution scores 29/100. Mark more forum threads resolved — the resolved ratio feeds the ranking.
83 health vs 66 average across 1,786 Security plugins
Install conversion
How it's measured →1.0%
of downloads still active
At least 1M of 98.3M lifetime downloads are still running, below its category: the median Security plugin keeps 1.4%, across 1,061 plugins.
Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Security plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.
This plugin shipped 25 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.
Details
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Most to gain: Support resolution
Updated 1 day ago
Tested up to WordPress 7.1.4, the current branch or newer
4.8★ over 1,489 reviews, weighted for review count to 4.8★
5 of 5 tags set · short description in place
2 of 7 support threads resolved in the last 2 months
To rank higher: Mark more forum threads resolved — the resolved ratio feeds the ranking.
Get the full rank-higher report →Search visibility
How it's tracked →Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.
31
Momentum
Losing ground
-2.0
Velocity
places per keyword, 28d
9%
Breadth
of keywords climbing, 28d
+0.3
Acceleration
recent half vs earlier
wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.
| Keyword | wp.org | On merit | wp.org move, 90 days |
|---|---|---|---|
| brute force protection | #1 | #1 | 0 |
| brute | #1 | #1 | 0 |
| brute force your tag | #1 | #1 | 0 |
| limit login attempts | #1 | #1 | 0 |
| limit login | #1 | #1 | 0 |
| limit | #1 | #1 | 0 |
| stop brute force attacks | #1 | #1 | 0 |
| login security your tag | #2 | #2 | 0 |
| force | #2 | #2 | down 1 |
| login attempts | #2 | #2 | down 1 |
| login | #2 | #2 | 0 |
| brute force attacks | #2 | #2 | down 1 |
| secure login | #2 | #2 | 0 |
| login monitoring | #2 | #2 | 0 |
| ip limit | #1 | #1 | 0 |
| limit attempts | #1 | #1 | 0 |
| login limit | #1 | #1 | 0 |
| 2fa your tag | #3 | #3 | down 1 |
| brute force prevention | #1 | #1 | 0 |
| login protection | #2 | #2 | 0 |
720 searches this plugin appeared in over the last 90 days, 20 listed. 618 left out as unrelated or noise (years, numbers, stray words).
What to do about it
- Your five tags are all earning their place. Each gets you onto page 1 of its own search, so none is worth giving up. “protection”, “bot protection” and “monitoring” (#4, #5 and #7 untagged) would be the next worth testing if a slot frees up.
Daily downloads
Since 5 Oct 2022 · 1,491 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peak 5.6M · peaks are release surges
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Rating trend
Star average over time · dips mark rough releases
Health trend
Composite health score, snapshotted daily
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Actively maintainedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
25
releases in the last 12 months
yesterday
latest release · v3.4.0 · 2 Nov 2026
135
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “1M+”. Our estimate pins where the real number sits.
Crossed into this band 6 months ago and the previous band took 4.5 years to cross, so the real count is still just under 2M.
Install history since 1 Jan 2022
Recent reviews
All reviews on wp.org ↗- ★★★★★ apacheleon4mo ago
La versión gratuita que estoy utilizando para mi sencilla pagina web en WordPress funciona a las mil maravillas y no da ningún problema. Muy recomedable.
Read on wp.org ↗ - ★★★★★ Van Tran4mo ago
Great Plugin, I really love it
Read on wp.org ↗ - ★★★★★ Nikolay Bronskiy4mo ago
Avoid! They silently added useless weekly reports. Basically it is just spam
Read on wp.org ↗ - ★★★★★ ellegphoto4mo ago
I feel so much better having installed this on my website. Russian Casino ppl hacked my website and this plugin gives me such peace of mind knowing they cant log in and cause more damage.
Read on wp.org ↗ - ★★★★★ ChrisL4mo ago
Without my requesting it, I’m now getting over a hundred weekly and monthly security summary emails from my clients’ websites. Enabling this on existing sites is a very annoying and ill-thought out decision which would take me a couple of hours of mindless clicking to disable. But why would I bother disabling it when it is quite likely that developer of Limit Login Attempts is likely to reenable the unwanted feature when they next update their plugin??@!# Feel free to set the feature to enabled by default on new installations. But existing sites should have the feature disabled by default when introduced in a plugin update.
Read on wp.org ↗ - ★★★★★ Ankh2474mo ago
Works well. Just what I needed. Thank you.
Read on wp.org ↗ - ★★★★★ spherical4mo ago
Without this service an admin would have no idea of the nefarious activity going on out of sight and right under our noses. Sometimes we get 20 or more notices of attempted logins that are blocked. Those IP#s get added to our growing .htaccess file denying any access at all. Good Work, Guys and Gals! Too bad that it has to be this way. There’s always bad actors lurking and we need all the help we can get. LLAR provides that in spades.
Read on wp.org ↗ - ★★★★★ redescristianas4mo ago
This plugin is a lifesaver! It successfully blocked a brute force attack on my website, preventing unauthorized access attempts. The setup was simple and the detailed logs helped me understand what was going on. Highly recommended for any WordPress site owner who takes security seriously.
Read on wp.org ↗
Latest updates
via wp.org changelogRecent releases and news for this plugin
- — Version 3.3.4 Fixed icon positioning. 3.3.4
- — Version 3.3.3 Fixed the dashboard incorrectly showing a network error when the cloud API is reachable but access is restricted. Fixed a PHP 8.1+ deprecation notice by avoiding implicit float-to-int conversion in the lockout email noti 3.3.3
- — Version 3.3.2 Improved usage information in cloud mode. Earlier versions For the changelog of earlier versions, please refer to the changelog.txt file. 3.3.2
- — Version 3.3.1 Fixed email digest behavior in cloud mode. 3.3.1
- — Version 3.3.0 Added daily, weekly, and monthly email digests summarizing lockouts and failed login attempts. 3.3.0
- — Version 3.2.4 Added compatibility with WordPress 7. Earlier versions For the changelog of earlier versions, please refer to the changelog.txt file. 3.2.4
Security history
via Wordfence IntelligenceAll 5 disclosed vulnerabilities are patched in the current version (3.4.0). Sites still on an older version should update.
- Patched Medium · 6.4 Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗2023-12-20 CVE-2023-6934 Improper Neutralization of Input During Web Page Generation Affects <= 2.25.26 Patched in 2.25.27
- 2020-12-14 CVE-2020-35590 Improper Restriction of Excessive Authentication Attempts Affects <= 2.17.3 Patched in 2.17.4
- 2020-12-14 CVE-2020-35589 Improper Neutralization of Input During Web Page Generation Affects <= 2.15.2 Patched in 2.17.4
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Languages
via translate.wordpress.orgTranslated into 42 languages, 14 at 90% or more
Plus 18 more locales with partial translations.
AI assistants
How it's measured →Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.
Share of voice
How often each assistant names Limit Login Attempts Security when asked about this topic, where it comes in the answer, and how that compares with its wp.org search position. Latest run 1 Nov 2026.
- Assistants
- ChatGPT, Claude
- Topics tracked
- Security
Readme readiness
6 of 8 pass · checked 29 Oct 2026Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.
- ! Says what it does Short description names no action; say what the plugin does for the site.
- ✓ Has a FAQ 10 questions in the FAQ.
- ✓ FAQ asks real questions 10 of 10 read like questions a user would type.
- ! Names who it is for One audience phrase ("built for"); say who the plugin is for and what they use it for.
- ✓ Names what it works with Mentions WooCommerce, MemberPress, Cloudflare, Multisite.
- ✓ Headings and lists 9 headings and 19 lists.
- ✓ Enough to quote 5,136 characters of description.
- ✓ Tags match the text All 5 tags appear in the text.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
- 2026-05-08 2M+ → 1M+ down after 1649 days in tier
- 2021-11-01 1M+ → 2M+ up after 731 days in tier
- 2019-11-01 700K+ → 1M+ up after 244 days in tier
- 2019-03-02 500K+ → 700K+ up after 87 days in tier
- 2018-12-05 200K+ → 500K+ up after 101 days in tier
- 2018-08-26 80K+ → 200K+ up after 143 days in tier
- 2018-04-05 50K+ → 80K+ up after 122 days in tier
- 2017-12-04 40K+ → 50K+ up after 61 days in tier
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
-
Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 3 shared tags A -
All-In-One Security (AIOS) – Security and Firewall 1M+ installs · 4.7★ · 3 shared tags A -
Anti-Malware Security and Brute-Force Firewall 100K+ installs · 4.9★ · 3 shared tags A -
Hide My WP Ghost – Security & Firewall 100K+ installs · 4.5★ · 3 shared tags B -
Defender Security – Malware Scanner, Login Security & Firewall 80K+ installs · 4.8★ · 3 shared tags A -
Security Plugin, Firewall & Malware Scanner with Auto Removal 40K+ installs · 4.7★ · 3 shared tags A
Embed this report card
Drop a live Pulse card for Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/limit-login-attempts-reloaded" width="480" height="300" style="border:0" loading="lazy" title="Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security — Plugin Pulse"></iframe> Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security: 1M+ active installs, 4.8★ (1,489 reviews). Plugin Pulse (WP Mayor), as of 2026-11-03. https://plugins.wpmayor.com/plugin/limit-login-attempts-reloaded
Spotted a number that looks wrong? Report a data issue and we'll check it against the source.