Rate limiting

Why it matters for WordPress

Without limits, bots can try thousands of passwords per hour against wp-login.php and xmlrpc.php. That burns server resources and raises the odds that a weak password eventually works. Soft limits turn the spray into a slow, noisy process you can detect and block.

Rate limiting is not the same as a permanent ban list. Good limits slow attackers while still letting real users recover from a typo.

How it shows up in practice

• Temporary lockouts after N failed logins from one IP
• HTTP 429 responses from a CDN, host, or application firewall
• Firewall rules that throttle a path (login, XML-RPC, search, checkout)
• Staff hitting limits from a shared office IP if the threshold is too strict

What to do

1. Rate-limit WordPress login and XML-RPC if you still expose them.
2. Prefer progressive delays or short temporary bans over permanent locks that attackers can use to DoS real users.
3. Allowlist trusted office or monitoring IPs carefully when staff share one egress address.
4. Pair limits with two-factor authentication so a successful guess still needs a second factor.
5. Watch failed-login volume in your events log after you tighten thresholds.

In WP Security Ninja

Pro login protection includes configurable failed-login limits: after too many bad attempts, further tries are blocked for that visitor instead of hammering PHP forever. Combine that with 2FA on admin roles when you want stolen or stuffed passwords to fail even if they are “correct.”