# Slow Down Failed Login Attempts

> Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, login, brute-force
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/slow-down-failed-logins/

## Code

```php
add_action( 'wp_login_failed', function () {
    // Random 1 to 2 second delay.
    usleep( wp_rand( 1000000, 2000000 ) );
} );
```

## Notes

Each delayed request keeps a PHP worker busy; combine with a login limiter on busy sites.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Slow Down Failed Login Attempts" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/