# Limit Guesses on Password-Protected Posts

> Allows each visitor at most 10 password attempts on password-protected posts and pages every 15 minutes, which stops bots from brute-forcing the post password.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: passwords, brute-force, content
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-limit-post-password-attempts/

## Code

```php
// Attempts allowed per window, and the window length in minutes.
$wpide_postpass_limit  = 10;
$wpide_postpass_window = 15;

add_action( 'login_form_postpass', function () use ( $wpide_postpass_limit, $wpide_postpass_window ) {
    $ip    = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
    $key   = 'wpide_postpass_' . md5( $ip );
    $count = (int) get_transient( $key );

    if ( $count >= $wpide_postpass_limit ) {
        wp_die( esc_html( sprintf( 'Too many password attempts. Please wait %d minutes and try again.', $wpide_postpass_window ) ), 429, array( 'back_link' => true ) );
    }

    set_transient( $key, $count + 1, $wpide_postpass_window * MINUTE_IN_SECONDS );
} );
```

## Notes

Every submission counts, including correct ones; the limit is per IP address.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Limit Guesses on Password-Protected Posts" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/