# Ban IPs That Try Common Attack Usernames

> Blocks an IP address from logging in for a day as soon as it tries a username like "admin" or "test" that does not exist on your site.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, login, brute-force
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/ban-attack-usernames/

## Code

```php
// Usernames that only bots try (they must not exist on your site).
$wpide_trap_usernames = array( 'admin', 'administrator', 'root', 'test', 'user', 'demo', 'wordpress', 'wp' );
$wpide_trap_ban_time  = DAY_IN_SECONDS;

$wpide_trap_key = function () {
    $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? (string) $_SERVER['REMOTE_ADDR'] : 'unknown';

    return 'wpide_trap_' . md5( $ip );
};

add_action( 'wp_login_failed', function ( $username ) use ( $wpide_trap_usernames, $wpide_trap_ban_time, $wpide_trap_key ) {
    $username = strtolower( trim( (string) $username ) );

    if ( in_array( $username, $wpide_trap_usernames, true ) && ! username_exists( $username ) ) {
        set_transient( $wpide_trap_key(), 1, $wpide_trap_ban_time );
    }
} );

add_filter( 'authenticate', function ( $user ) use ( $wpide_trap_key ) {
    if ( get_transient( $wpide_trap_key() ) ) {
        return new WP_Error( 'wpide_trap_banned', '<strong>Error:</strong> Login is temporarily blocked from your network.' );
    }

    return $user;
}, 1 );
```

## Notes

Never list a username that a real person on your site uses.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Ban IPs That Try Common Attack Usernames" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/