Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
by WPChef · Security
Also makes 5 other plugins · 1M+ installs across the portfolio →
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.
Health
A 85/100
no flags
Active installs
1M+
≈1.5M estimated
Momentum
-58%
downloads vs prior 30d
Biggest opportunity: Support resolution scores 38/100. Mark more forum threads resolved — the resolved ratio feeds the ranking.
85 health vs 66 average across 1,778 Security plugins
Install conversion
How it's measured →1.0%
of downloads still active
At least 1M of 98.2M lifetime downloads are still running, below its category: the median Security plugin keeps 1.4%, across 1,061 plugins.
Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Security plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.
This plugin shipped 24 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.
Details
Recent review vibe
read from the latest 12 reviews to 2026-07-16Older reviews still praise it for stopping brute force attacks, but the newest ones complain about an unwanted weekly and monthly report feature quietly turned on without consent, plus a Cloudflare WAF conflict blocking the 2FA endpoint.
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Most to gain: Support resolution
Updated 40 days ago
Tested up to WordPress 7.1.4, the current branch or newer
4.8★ over 1,489 reviews, smoothed to 4.78★
5 of 5 tags set · short description in place
3 of 8 support threads resolved in the last 2 months
To rank higher: Mark more forum threads resolved — the resolved ratio feeds the ranking.
Get the full rank-higher report →Search visibility
How it's tracked →Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.
30
Momentum
Losing ground
-2.0
Velocity
places per keyword, 28d
8%
Breadth
of keywords climbing, 28d
+0.1
Acceleration
recent half vs earlier
wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.
| Keyword | wp.org | On merit | wp.org move, 90 days |
|---|---|---|---|
| brute | #1 | #1 | 0 |
| brute force your tag | #1 | #1 | 0 |
| login attempts | #1 | #1 | 0 |
| limit login attempts | #1 | #1 | 0 |
| limit login | #1 | #1 | 0 |
| limit | #1 | #1 | 0 |
| brute force prevention | #1 | #1 | 0 |
| prevention | #1 | #1 | 0 |
| mfa | #1 | #1 | 0 |
| login security your tag | #2 | #2 | 0 |
| force | #2 | #2 | down 1 |
| login | #2 | #2 | 0 |
| brute force protection | #2 | #2 | down 1 |
| login monitoring | #2 | #2 | 0 |
| country blocking | #2 | #2 | 0 |
| ip limit | #1 | #1 | 0 |
| limit attempts | #1 | #1 | 0 |
| login limit | #1 | #1 | 0 |
| easy login | #1 | #1 | 0 |
| 2fa your tag | #3 | #3 | down 1 |
686 searches this plugin appeared in over the last 90 days, 20 listed. 535 left out as unrelated or noise (years, numbers, stray words).
What to do about it
- Your five tags are all earning their place. Each gets you onto page 1 of its own search, so none is worth giving up. “bot protection”, “hide login” and “ip country” (#4, #4 and #5 untagged) would be the next worth testing if a slot frees up.
Daily downloads
Since 5 Oct 2022 · 1,490 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peak 5.6M · peaks are release surges
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Rating trend
Star average over time · dips mark rough releases
Health trend
Composite health score, snapshotted daily
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Actively maintainedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
24
releases in the last 12 months
1mo ago
latest release · v3.3.10 · 23 Sep 2026
134
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin · 48% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “1M+”. Our estimate pins where the real number sits.
Crossed into this band 6 months ago; a band this size takes about a year or more to cross, which places it about 51% of the way through.
Install history since 1 Nov 2021
Recent reviews
All reviews on wp.org ↗- ★★★★★ apacheleon4mo ago
La versión gratuita que estoy utilizando para mi sencilla pagina web en WordPress funciona a las mil maravillas y no da ningún problema. Muy recomedable.
Read on wp.org ↗ - ★★★★★ Van Tran4mo ago
Great Plugin, I really love it
Read on wp.org ↗ - ★★★★★ Nikolay Bronskiy4mo ago
Avoid! They silently added useless weekly reports. Basically it is just spam
Read on wp.org ↗ - ★★★★★ ellegphoto4mo ago
I feel so much better having installed this on my website. Russian Casino ppl hacked my website and this plugin gives me such peace of mind knowing they cant log in and cause more damage.
Read on wp.org ↗ - ★★★★★ ChrisL4mo ago
Without my requesting it, I’m now getting over a hundred weekly and monthly security summary emails from my clients’ websites. Enabling this on existing sites is a very annoying and ill-thought out decision which would take me a couple of hours of mindless clicking to disable. But why would I bother disabling it when it is quite likely that developer of Limit Login Attempts is likely to reenable the unwanted feature when they next update their plugin??@!# Feel free to set the feature to enabled by default on new installations. But existing sites should have the feature disabled by default when introduced in a plugin update.
Read on wp.org ↗ - ★★★★★ Ankh2474mo ago
Works well. Just what I needed. Thank you.
Read on wp.org ↗ - ★★★★★ spherical4mo ago
Without this service an admin would have no idea of the nefarious activity going on out of sight and right under our noses. Sometimes we get 20 or more notices of attempted logins that are blocked. Those IP#s get added to our growing .htaccess file denying any access at all. Good Work, Guys and Gals! Too bad that it has to be this way. There’s always bad actors lurking and we need all the help we can get. LLAR provides that in spades.
Read on wp.org ↗ - ★★★★★ redescristianas4mo ago
This plugin is a lifesaver! It successfully blocked a brute force attack on my website, preventing unauthorized access attempts. The setup was simple and the detailed logs helped me understand what was going on. Highly recommended for any WordPress site owner who takes security seriously.
Read on wp.org ↗
Latest updates
via wp.org changelogRecent releases and news for this plugin
- — Version 3.3.4 Fixed icon positioning. 3.3.4
- — Version 3.3.3 Fixed the dashboard incorrectly showing a network error when the cloud API is reachable but access is restricted. Fixed a PHP 8.1+ deprecation notice by avoiding implicit float-to-int conversion in the lockout email noti 3.3.3
- — Version 3.3.2 Improved usage information in cloud mode. Earlier versions For the changelog of earlier versions, please refer to the changelog.txt file. 3.3.2
- — Version 3.3.1 Fixed email digest behavior in cloud mode. 3.3.1
- — Version 3.3.0 Added daily, weekly, and monthly email digests summarizing lockouts and failed login attempts. 3.3.0
- — Version 3.2.4 Added compatibility with WordPress 7. Earlier versions For the changelog of earlier versions, please refer to the changelog.txt file. 3.2.4
Security history
via Wordfence IntelligenceAll 5 disclosed vulnerabilities are patched in the current version (3.3.10). Sites still on an older version should update.
- Patched Medium · 6.4 Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗2023-12-20 CVE-2023-6934 Improper Neutralization of Input During Web Page Generation Affects <= 2.25.26 Patched in 2.25.27
- 2020-12-14 CVE-2020-35590 Improper Restriction of Excessive Authentication Attempts Affects <= 2.17.3 Patched in 2.17.4
- 2020-12-14 CVE-2020-35589 Improper Neutralization of Input During Web Page Generation Affects <= 2.15.2 Patched in 2.17.4
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Languages
via translate.wordpress.orgTranslated into 42 languages, 14 at 90% or more
Plus 18 more locales with partial translations.
AI assistants
How it's measured →Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.
Share of voice
How often each assistant names Limit Login Attempts Security when asked about this topic, where it comes in the answer, and how that compares with its wp.org search position. Latest run 1 Nov 2026.
- Assistants
- ChatGPT, Claude
- Topics tracked
- Security
Readme readiness
6 of 8 pass · checked 29 Oct 2026Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.
- ! Says what it does Short description names no action; say what the plugin does for the site.
- ✓ Has a FAQ 10 questions in the FAQ.
- ✓ FAQ asks real questions 10 of 10 read like questions a user would type.
- ! Names who it is for One audience phrase ("built for"); say who the plugin is for and what they use it for.
- ✓ Names what it works with Mentions WooCommerce, MemberPress, Cloudflare, Multisite.
- ✓ Headings and lists 9 headings and 19 lists.
- ✓ Enough to quote 5,136 characters of description.
- ✓ Tags match the text All 5 tags appear in the text.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
- 2026-05-08 2M+ → 1M+ down after 2 days in tier
- 2026-05-06 1M+ → 2M+ up after 1 days in tier
- 2026-05-05 2M+ → 1M+ down after 1646 days in tier
- 2021-11-01 1M+ → 2M+ up after 731 days in tier
- 2019-11-01 700K+ → 1M+ up after 244 days in tier
- 2019-03-02 500K+ → 700K+ up after 87 days in tier
- 2018-12-05 200K+ → 500K+ up after 101 days in tier
- 2018-08-26 80K+ → 200K+ up after 143 days in tier
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
-
Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 3 shared tags A -
All-In-One Security (AIOS) – Security and Firewall 1M+ installs · 4.7★ · 3 shared tags A -
Anti-Malware Security and Brute-Force Firewall 100K+ installs · 4.9★ · 3 shared tags A -
Hide My WP Ghost – Security & Firewall 100K+ installs · 4.5★ · 3 shared tags A -
Defender Security – Malware Scanner, Login Security & Firewall 80K+ installs · 4.8★ · 3 shared tags A -
Security Plugin, Firewall & Malware Scanner with Auto Removal 40K+ installs · 4.7★ · 3 shared tags A
Embed this report card
Drop a live Pulse card for Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/limit-login-attempts-reloaded" width="480" height="300" style="border:0" loading="lazy" title="Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention — Plugin Pulse"></iframe> Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention: 1M+ active installs, 4.8★ (1,489 reviews). Plugin Pulse (WP Mayor), as of 2026-11-02. https://plugins.wpmayor.com/plugin/limit-login-attempts-reloaded
Spotted a number that looks wrong? Report a data issue and we'll check it against the source.