1
Wordfence Security Included
Limits login attempts and locks out attackers.
80feature score
WordPress Security Plugins with Brute-force protection
Limits failed logins and locks out attackers guessing passwords. 12 of the 12 plugins we track include it.
2
Sucuri Security Paid version Basic Firewall
Brute-force blocking is a firewall feature; the free plugin only logs failed logins.
87feature score
3
Defender Security Included
Configurable lockouts after failed logins (default 5 in 300 seconds).
79feature score
4
Shield Security Included
Failed logins add offense points and trigger automatic IP blocks.
84feature score
5
MalCare Security Included
Login protection with rate limiting of failed logins on every plan, including XML-RPC.
80feature score
6
Kadence Security (formerly Solid Security) Included
Local lockouts plus network-wide brute-force protection in the free plugin.
77feature score
7
WP Cerber Security Included
Limits login attempts by IP address or Class C subnet.
69feature score
8
All-In-One Security (AIOS) Included
Limits failed logins with configurable lockouts.
61feature score
9
Really Simple Security Paid version Pro
Limit Login Attempts with configurable thresholds.
54feature score
10
Patchstack Paid version Personal protection
Paid login protection blocks wp-login.php except via a secret allowlisting link; rate limiting in hardening.
60feature score
11
Jetpack Protect Included
Blocks botnet and repeated login attempts by default.
51feature score
12
Limit Login Attempts Reloaded Included
Core feature: lockouts after failed logins by IP and username.
33feature score