Wordfence Security
Endpoint firewall, malware scanner and login security plugin for WordPress, with paid tiers for real-time threat data and hands-on incident response.
80
Limit Login Attempts Reloaded
Lightweight WordPress login protection that limits failed attempts and adds 2FA, with paid cloud plans for country blocking and global IP denylists.
Free installs1M+WordPress.org, active
Est. Pro installs~61KLikely 31K–120K
Vendor claims2M+Vendor's own figure
Rating4.8/51,489 reviews
Price from$30/yrFreemium
Last updated2 Nov 2026Version 3.4.0
Overview
Limit Login Attempts Reloaded is a focused login-protection plugin and one of the most installed security plugins on WordPress.org. It does one job: stopping brute-force and credential-stuffing attacks against wp-login.php, XML-RPC and WooCommerce login forms. It is not a full security suite and does not scan files or filter general site traffic.
Free version
The free plugin counts failed logins by IP and username and locks out offenders for a configurable period, with longer lockouts for repeat attempts. You can manage IP and username safelists and denylists (IPv6 supported), set a custom IP origin for sites behind proxies such as Cloudflare, view failed-login and lockout logs, and receive email notifications when lockouts occur. Recent versions add built-in two-factor authentication, and the plugin supports multisite.
Premium cloud plans
Paid plans move lockout decisions to LLAR’s cloud. The Personal plan adds the login firewall, IP throttling, a performance optimiser that offloads failed requests (50,000 per month), IP intelligence and successful-login logs. Business adds country blocking, a global denylist of known malicious IPs, automatic IP denylisting and real-time cloud protection, with 300,000 requests per month. Agency plans cover multiple domains and synchronise lockouts, safelists and denylists across them. Plans are offered monthly, yearly or as lifetime purchases.
Limitations
Outside login protection there is little here: no malware or vulnerability scanning, no general web application firewall, no CAPTCHA, no login URL changer, no password policies and no hardening tweaks beyond XML-RPC login protection. Refunds are limited to the 7-day trial period.
It is a sensible choice when you already have scanning and a firewall from your host or another plugin and simply want reliable, low-overhead brute-force protection, or when a site is under heavy login attacks and you want the cloud to absorb them.
Best for: Sites that already have scanning and a firewall elsewhere but need dependable, lightweight brute-force protection.
Limit Login Attempts Reloaded does login lockouts well and stays out of the way, and the free 2FA is a welcome addition. It is not a replacement for a full security plugin, so treat it as a login layer; the cheap cloud plans are worth it for sites under sustained login attacks.
Pros
- Simple, low-overhead brute-force protection that works on activation
- Covers wp-login.php, XML-RPC and WooCommerce logins
- IP and username safelists and denylists with IPv6
- Free built-in two-factor authentication
- Cloud plans offload login attacks from the server
- Inexpensive paid tiers with lifetime options
Cons
- Login protection only: no scanning, WAF or hardening
- No CAPTCHA or login URL change
- Country blocking and global denylist need the Business plan
- No refunds outside the 7-day trial
Key features
What Limit Login Attempts Reloaded highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Limit failed logins by IP and username
- Automatic lockouts with adjustable durations
- Protects wp-login.php, XML-RPC and WooCommerce
- IP and username safelists and denylists
- IPv6 and custom IP origin support
- Built-in two-factor authentication
- Failed login and lockout logs
- Lockout email notifications
- Multisite compatible
Pro / paid adds From $30/yr
- Cloud login firewall
- IP throttling
- Performance optimiser offloading failed logins
- IP intelligence with enriched data
- Successful login logs
- Deny access by country
- Global denylist of malicious IPs
- Automatic IP denylisting
- Synchronised lockouts across sites
- CSV export of logs
- Lifetime licence option
Feature checklist
9 of 26 features we track in Security Plugins, feature score 33/100
Firewall & blocking 5/7
Web application firewall Key
Filters malicious requests (SQL injection, XSS and similar) before they reach WordPress.
Only login requests are filtered; no general SQLi/XSS request filtering.
Not included
Cloud / DNS-level firewall
Firewall runs on the vendor's network in front of your server, not inside WordPress.
Paid plans process login attempts in LLAR's cloud; it is not a proxy for the whole site.
Partial
Brute-force protection Key
Limits failed logins and locks out attackers guessing passwords.
Core feature: lockouts after failed logins by IP and username.
Included
Login CAPTCHA
CAPTCHA or Turnstile on login, registration and password reset forms.
No CAPTCHA option is listed in the plugin or plan matrix.
Not included
Rate limiting & bot blocking
Throttles or blocks aggressive crawlers and bad bots.
IP throttling of login traffic on paid plans; not general crawler throttling.
Paid version Personal
Country blocking
Block or allow traffic by country.
Deny By Country is included from the Business plan.
Paid version Business
Real-time IP blocklist
Blocks IPs known for attacks using shared threat intelligence.
Global denylist of known malicious IPs on Business and Agency.
Paid version Business
Scanning & cleanup 0/6
Malware scanner Key
Scans files and database for malware, backdoors and injected code.
No file or database scanning.
Not included
File change detection
Compares core, plugin and theme files with originals and flags changes.
No file integrity checks.
Not included
Vulnerability alerts Key
Warns when installed plugins, themes or core have known vulnerabilities.
Does not check plugins or themes for known vulnerabilities.
Not included
Scheduled scans
Runs scans automatically on a schedule.
No scanning features.
Not included
Off-site scanning
Scans run on the vendor's servers so they don't slow your site.
No scanning features.
Not included
Malware removal
One-click or expert cleanup of infected sites.
No cleanup service.
Not included
Login security 1/5
Two-factor authentication Key
Second login factor via authenticator app, email or similar.
Built-in 2FA is part of the free plugin.
Included
Passkeys / WebAuthn
Passwordless login with passkeys or hardware security keys.
Passkeys are not offered.
Not included
Password policies
Enforce strong passwords, expiry or breached-password checks.
No password strength or breach checks.
Not included
Custom login URL
Move or hide the wp-login.php / wp-admin login page.
Does not move the login page; it works alongside custom login plugins.
Not included
Session management
View and end active user sessions, limit concurrent logins.
No session listing or concurrent-login limits.
Not included
Hardening 0/5
One-click hardening
Disable XML-RPC, file editing, user enumeration and similar weak points.
Beyond XML-RPC login protection there are no hardening toggles.
Not included
SSL / HTTPS tools
Enforce HTTPS, fix mixed content and redirects.
No HTTPS tools.
Not included
Security headers
Set HSTS, CSP, X-Frame-Options and other HTTP security headers.
No security header settings.
Not included
Virtual patching
Firewall rules that block exploits for known plugin vulnerabilities before an update is available.
No virtual patching.
Not included
Auto-update vulnerable plugins
Automatically updates plugins with known vulnerabilities.
No update management.
Not included
Monitoring & management 3/3
Activity log Key
Records logins, changes and admin actions for auditing.
Logs failed logins and lockouts free; successful logins on paid plans; no general audit log.
Partial
Security alerts
Email or app alerts for attacks, lockouts and scan results.
Email notifications when lockouts happen.
Included
Multi-site dashboard
Manage security for many sites from one dashboard.
Cloud app syncs lockouts, safelists and denylists across multiple domains.
Paid version Agency
Pricing
Free
$0On WordPress.org
Personal
$30per year1 site
List $2.50/mo; shown at $1.25/mo (50% off) billed yearly. 50K cloud requests/month. Lifetime option $104.99.
Business
$100per year1 site
List $8.33/mo; shown at $4.17/mo (50% off) billed yearly. 300K requests, country blocking, global denylist. Lifetime $349.99.
Agency
$450per year10 sites
Shown at $224.99/yr (58% off). Business features, 100K requests per domain; per-domain pricing above 10 domains.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use Limit Login Attempts Reloaded?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
1M+
Active installations reported by WordPress.org.
Vendor claim
2M+
Sites/users claimed on the vendor's website. source
Estimated Pro / paid installs
~61K
Our estimate, see method below.
How we estimated this: WordPress.org shows 1M+ free installs, which could mean anything from 1M to 2M. The vendor says 2M+ sites, so we put the free count halfway between the middle of that range and the vendor figure, at about 1.8M. About 1.8M free installs x 3.5% (the usual share of free sites that also run the paid version when a hosted service whose free tier is generous, lower for very large free bases) gives 61K. Likely range: 31K to 120K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
79,828 downloads last week, 98.3M all time
Rating breakdown
| Version | 3.4.0 |
|---|---|
| Last updated | 2 Nov 2026 (1 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 5.0+ |
| Support threads (2 months) | 2 of 7 resolved |
| On WordPress.org since | 3 Aug 2016 |
Company & policy
| Refund policy | No refunds outside the 7-day trial (source, 5 Oct 2026) |
|---|
Limit Login Attempts Reloaded compared
Limit Login Attempts Reloaded/Wordfence Security
Jetpack Protect/Limit Login Attempts Reloaded
Limit Login Attempts Reloaded/MalCare Security
Limit Login Attempts Reloaded/Shield Security
Defender Security/Limit Login Attempts Reloaded
Limit Login Attempts Reloaded/Patchstack
Limit Login Attempts Reloaded/WP Cerber Security
Limit Login Attempts Reloaded/Kadence Security (formerly Solid Security)
Limit Login Attempts Reloaded/Sucuri Security
All-In-One Security (AIOS)/Limit Login Attempts Reloaded
Limit Login Attempts Reloaded/Really Simple Security Alternatives to Limit Login Attempts Reloaded
Sucuri Security
Free auditing, file integrity and remote scanning plugin from Sucuri that connects to its paid cloud firewall and malware cleanup platform.
87
Defender Security
WPMU DEV's WordPress security plugin with malware scanning, AntiBot firewall, 2FA with passkeys, hardening and audit logs; Pro adds scheduled scans.
79
Shield Security
Automated WordPress security plugin with firewall, silentCAPTCHA bot detection, 2FA and audit log; ShieldPRO adds malware and vulnerability scanning.
84
MalCare Security
Cloud-scanning WordPress security plugin with a plugin-level firewall, login protection and paid one-click malware cleanup, for site owners and agencies.
80
Kadence Security (formerly Solid Security)
Login-focused WordPress security plugin (formerly Solid Security / iThemes Security) with 2FA, brute-force protection and Patchstack virtual patching in Pro.
77
FAQ
Is Limit Login Attempts Reloaded free?
Yes. Limit Login Attempts Reloaded has a free version on WordPress.org. Paid plans start at $30/yr.
How many sites use Limit Login Attempts Reloaded?
WordPress.org reports 1M+ active installations of the free version. The vendor claims 2M+ sites in total. We estimate around 61K sites run the paid version.
Does Limit Login Attempts Reloaded have web application firewall?
No: not included. Only login requests are filtered; no general SQLi/XSS request filtering.
Does Limit Login Attempts Reloaded have brute-force protection?
Yes: included. Core feature: lockouts after failed logins by IP and username.
Does Limit Login Attempts Reloaded have malware scanner?
No: not included. No file or database scanning.
Does Limit Login Attempts Reloaded have vulnerability alerts?
No: not included. Does not check plugins or themes for known vulnerabilities.
Does Limit Login Attempts Reloaded have two-factor authentication?
Yes: included. Built-in 2FA is part of the free plugin.
Does Limit Login Attempts Reloaded have activity log?
Yes: partial. Logs failed logins and lockouts free; successful logins on paid plans; no general audit log.
Is Limit Login Attempts Reloaded a full security plugin?
No. It focuses on login protection. Pair it with a scanner and firewall (from your host or another plugin) for broader coverage.
Does it work with WooCommerce and Cloudflare?
Yes. It protects WooCommerce login pages, and you can set a custom IP origin so lockouts use the real visitor IP behind Cloudflare.
What do the paid plans add?
Cloud processing of login attempts, IP throttling and intelligence, successful-login logs, and on Business and Agency, country blocking and a global malicious-IP denylist.
Can I get a refund?
Only within the 7-day trial; after that you can cancel any time but the current billing period is not refunded.
Last updated 5 Oct 2026. Spotted something wrong? Suggest an edit.