# Limit Failed Login Attempts

> Temporarily blocks an IP address after 5 failed logins within 15 minutes. A lightweight brute-force guard with no settings screen.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, login, brute-force
- Author: WPIDE Team
- Installs: 6
- Updated: 2026-10-28
- Page: https://wpide.com/library/limit-login-attempts/

## Code

```php
$wpide_login_limit = array(
    'attempts' => 5,
    'window'   => 15 * MINUTE_IN_SECONDS,
);

$wpide_login_key = function () {
    $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : 'unknown';

    return 'wpide_login_fail_' . md5( $ip );
};

add_filter( 'authenticate', function ( $user, $username ) use ( $wpide_login_limit, $wpide_login_key ) {
    if ( empty( $username ) ) {
        return $user;
    }

    if ( (int) get_transient( $wpide_login_key() ) >= $wpide_login_limit['attempts'] ) {
        return new WP_Error(
            'wpide_too_many_attempts',
            sprintf( '<strong>Error:</strong> Too many failed login attempts. Please try again in %d minutes.', (int) ceil( $wpide_login_limit['window'] / MINUTE_IN_SECONDS ) )
        );
    }

    return $user;
}, 99, 2 );

add_action( 'wp_login_failed', function ( $username, $error = null ) use ( $wpide_login_limit, $wpide_login_key ) {
    if ( is_wp_error( $error ) && 'wpide_too_many_attempts' === $error->get_error_code() ) {
        return;
    }

    $key = $wpide_login_key();
    set_transient( $key, (int) get_transient( $key ) + 1, $wpide_login_limit['window'] );
}, 10, 2 );

add_action( 'wp_login', function () use ( $wpide_login_key ) {
    delete_transient( $wpide_login_key() );
} );
```

## Notes

Behind a proxy or CDN, REMOTE_ADDR may be the proxy address; configure your server to pass the real visitor IP. Do not combine with another login limiter.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Limit Failed Login Attempts" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/