Set a failed-login threshold and a block window to slow repeated attempts from the same address.
Available in the current release.
This example uses your configured threshold and block duration. It does not assume one universal setting fits every site.
Same address · 192.0.2.24
The password was rejected. The failure is counted.
Failures from this address add up within the configured window.
The threshold has been reached. This address cannot keep guessing.
Further attempts are refused during the block window. Review the activity in your log.
Someone submits credentials that WordPress does not accept.
FluentAuth counts failures from that IP address within the configured window.
Once the address reaches your threshold, the configured restriction takes effect.
Further attempts are blocked for that window. You can review the event in the log and receive an alert if enabled.
An automated script can try the login form repeatedly. Without a limit, the same address can keep testing guesses while your team has little reason to notice.
FluentAuth counts failed attempts from an address and applies the block window you choose. It slows repeated guesses from that address and leaves an activity trail for review. Distributed attempts still need other protections, including two-factor authentication.
Let real users retry a mistake while putting a clear boundary around repeated failures.
Get FluentAuth →Available in the current release.
Follow the setup guide →
Start with settings that leave room for genuine mistakes. Shared office or mobile networks can put several users behind one address, so review actual activity before making the policy stricter.
Attempt limits address repeated guesses from an address. Two-factor authentication adds protection when someone already has the correct password. These controls serve different purposes and work well together.
An allow rule can exempt an address from the attempt limit. It does not exempt that address from two-factor authentication. Sites behind a proxy must configure trusted proxies correctly before relying on forwarded visitor addresses.
Install FluentAuth, choose your attempt policy and pair it with verification for privileged accounts.