Limit Guesses on Password-Protected Posts
Allows each visitor at most 10 password attempts on password-protected posts and pages every 15 minutes, which stops bots from brute-forcing the post password.
Opens WPIDE on
Code
// Attempts allowed per window, and the window length in minutes.
$wpide_postpass_limit = 10;
$wpide_postpass_window = 15;
add_action( 'login_form_postpass', function () use ( $wpide_postpass_limit, $wpide_postpass_window ) {
$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
$key = 'wpide_postpass_' . md5( $ip );
$count = (int) get_transient( $key );
if ( $count >= $wpide_postpass_limit ) {
wp_die( esc_html( sprintf( 'Too many password attempts. Please wait %d minutes and try again.', $wpide_postpass_window ) ), 429, array( 'back_link' => true ) );
}
set_transient( $key, $count + 1, $wpide_postpass_window * MINUTE_IN_SECONDS );
} );Notes
Every submission counts, including correct ones; the limit is per IP address.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.