Limit Login Attempts Reloaded Review: Login Security Insights

Quick Verdict: Limit Login Attempts Reloaded is one of the most widely installed WordPress security plugins in the world, and for straightforward brute-force protection, the free version genuinely delivers. But it is not a complete security solution, and the gap between what the free tier offers and what the premium tier unlocks is substantial enough to warrant careful thought before you commit.

1. Overview and Background

WordPress, by design, does not place any restriction on the number of times someone can attempt to log in to a site. From a usability standpoint this makes sense — a user who forgets their password should not be locked out permanently. From a security standpoint, however, it creates a wide-open door for automated brute-force attacks, where scripts cycle through thousands of username and password combinations until they find a match.

Limit Login Attempts Reloaded (LLAR) addresses this gap directly. The plugin traces its roots to an older plugin called Limit Login Attempts, originally written by Johan Eenfeldt. When development on that original plugin stalled, Atlantic Silicon Inc. picked up the codebase, modernised it, and relaunched it under the Reloaded banner. Today it sits among the most installed security plugins in the WordPress repository, with over 2.5 million active installations as of 2025.

The plugin’s core proposition is simple: track failed login attempts per IP address, and after a configurable threshold is crossed, block that IP from trying again for a defined period. Premium tiers extend this model into a cloud-based infrastructure that intercepts and absorbs attacks before they even touch your server.

2. How the Plugin Works

2.1 The Core Mechanism

WordPress’s default login flow processes every single login request directly on your server — good or bad. LLAR hooks into the WordPress authentication process using native WordPress actions and filters. When a login attempt fails, the plugin increments a counter stored in the WordPress database against that specific IP address. Once the counter reaches the configured limit, subsequent attempts from that IP are blocked until the lockout period expires.

This local blocking approach is the foundation of the free version. It is effective but reactive: the plugin still allows each attempt to reach your server before deciding whether to process or reject it. Under a low-volume attack, this is inconsequential. Under a high-volume distributed attack, each request still consumes server resources before being turned away, which can degrade site performance.

2.2 Scope of Protection

LLAR does not restrict its protection to the standard wp-login.php endpoint. The plugin also covers:

• XMLRPC (xmlrpc.php) — a commonly exploited entry point for credential stuffing attacks
• WooCommerce login pages — important for e-commerce sites with customer accounts
• Custom login pages — provided they use standard WordPress authentication hooks
• Authentication cookies — preventing cookie-based brute-force methods

This breadth of coverage is meaningful. Many site owners lock down the standard login page but forget about XMLRPC, which historically has been a significant attack vector. LLAR’s handling of XMLRPC by default is a practical advantage over simpler implementations.

2.3 Cloud-Based Protection (Premium)

The premium and Micro Cloud tiers shift the attack interception point away from your server entirely. Failed login attempts are routed to LLAR’s cloud infrastructure, which evaluates the IP against a shared database of known malicious addresses. This database is crowdsourced from across the LLAR user network — when a malicious IP attacks one site, it gets flagged across all participating sites.

The result is that in the premium model, your server does far less work during an attack. The cloud absorbs the request volume, runs the intelligence checks, and only passes through legitimate traffic. For heavily targeted sites or sites on shared hosting where bandwidth is constrained, this architectural difference is material.

3. Feature Breakdown

3.1 Free Version Features

The free version covers the essential use case adequately. Here is what you get out of the box:

• Core protection: Login Attempt Limiting
• Set the number of allowed retries per IP before a lockout is triggered. The default is four attempts, which is a reasonable starting point for most sites.
• Lockout control: Configurable Lockout Timings
• Two-tier lockout system. First lockout applies a short delay (default: 20 minutes). If the same IP triggers another lockout shortly afterwards, the second lockout is significantly longer (default: 24 hours). This progressive escalation discourages persistent attackers.
• User feedback: Remaining Attempts Display
• The login page tells users how many attempts they have remaining or how long they need to wait. This is a small UX touch that reduces support requests from legitimate users who mistyped their password.
• Admin alerts: Lockout Email Notifications
• Sends an email to the administrator when an IP is locked out. Useful, though for high-traffic sites under sustained attack, this can generate a significant volume of notification emails. Version 2.17 made this setting enabled by default, which caught some users off-guard.
• Manual access control: IP Safelist and Denylist
• Manually add trusted IPs (such as your own office or home IP) to a safelist, or add known bad actors to a denylist. Username-level safelisting and denylisting is also supported.
• Privacy: GDPR Compliance Mode
• Adds a notice on the login screen informing users that IP addresses are being tracked. With this mode enabled, logged IPs can also be obfuscated via MD5 hashing, which satisfies certain GDPR interpretations around IP address storage.
• Extended coverage: XMLRPC and WooCommerce Protection
• Both are protected by default without additional configuration.
• Network support: Multi-site Compatibility
• Works on WordPress multisite installations with additional MU-specific settings.
• Proxy handling: Custom IP Origin Support
• Supports Cloudflare, Sucuri, Nginx, and other reverse proxy setups where the real visitor IP needs to be read from a custom header rather than the standard REMOTE_ADDR variable.

3.2 Micro Cloud (Free Tier with Data Sharing)

Micro Cloud sits between the free and paid plans. It is free to activate — no credit card required — but in exchange, the site contributes its bad IP data to LLAR’s shared cloud database. Micro Cloud users get access to the premium cloud features including the login firewall, IP intelligence, and country blocking, but with a capped request quota.

The first month provides 1,000 cloud requests; subsequent months provide 100 requests. For a quiet site that rarely experiences attacks, 100 requests per month may be sufficient. For a site under active or moderate attack, the quota will run out quickly, after which the plugin silently drops back to free-version behaviour until the next month. This automatic fallback is advertised as a feature — no manual intervention needed — but it also means your protection level changes mid-month without necessarily notifying you.

Worth noting: at least one user in the community has raised a concern that login attempts appeared to spike significantly shortly after signing up for Micro Cloud. This is anecdotal and unverified, but it is the kind of observation that raises eyebrows. There is an inherent conflict of interest in any model where a security vendor benefits from the existence of the threat it is selling protection against. We are not making an accusation here, but it is a dynamic worth being aware of.

3.3 Premium Features

The paid plans extend the plugin substantially. Key additions include:

• Enhanced IP Intelligence — Cross-references attacking IPs against a shared database of known malicious addresses, enabling proactive blocking rather than reactive lockouts.
• Auto IP Denylist — Automatically adds repeat offenders to an active denylist rather than just issuing temporary lockouts.
• Global Denylist Protection — Taps into LLAR’s network-wide database of flagged IPs, giving your site the benefit of threat data collected across thousands of other WordPress installations.
• Deny By Country — Blocks login attempts from specific countries. Useful for sites whose legitimate users are geographically concentrated. Pre-programmed country IP ranges are included, which simplifies setup compared to building your own CIDR block lists.
• Synchronized Lockouts — For agencies or developers managing multiple sites, lockout data can be shared across domains so that an IP blocked on one site is blocked on all managed sites simultaneously.
• Successful Login Logs — Cloud-stored logs of successful logins, including IP, city, state, and geographic coordinates. Not available in the free tier.
• Enhanced Lockout Logs with CSV Export — Richer data on the origins of attacking IPs, downloadable for offline analysis.
• Cloud Admin Unlock — If you lock yourself out, you can unlock your admin account directly through the cloud interface without needing FTP or file manager access.
• Auto Backups of IP Data — IP lists are backed up in the cloud, preventing loss of your configured access rules.
• Priority Email Support — 7-days-a-week email support from the LLAR security team.

4. Installation and Setup

Installation follows the standard WordPress plugin workflow. Navigate to Plugins > Add New, search for the plugin by name, install, and activate. The plugin is immediately functional after activation with sensible default settings, which means even a non-technical user gets baseline protection without configuration.

The settings panel is organised into tabs: General, App Settings, Logs, and (for cloud users) Cloud. The interface is clean and reasonably labelled, with explanatory text alongside each setting. This is one area where LLAR genuinely distinguishes itself — the settings are described in plain English rather than technical jargon, making it approachable for site owners who are not security professionals.

The one area where setup can become complex is IP origin configuration for sites behind a CDN or reverse proxy. If your site sits behind Cloudflare, for example, the default IP detection logic will read Cloudflare’s IP address rather than the actual visitor’s IP. This means all of your visitors appear to come from the same IP, and a lockout triggered by one bad actor will lock out everyone. LLAR provides a Trusted IP Origin setting to address this, but configuring it correctly requires understanding which HTTP header your proxy uses to pass the real IP. The premium cloud version handles this automatically, which is one of the most practical advantages of upgrading.

5. Performance Impact

LLAR’s performance footprint on the free tier is minimal. Independent testing by WP Hive found the plugin’s memory usage to be below the average memory impact of WordPress plugins, and its effect on page speed to be negligible under normal conditions. The plugin passed PHP error checks without warnings on PHP 8.1 and above.

The performance picture changes during an active brute-force attack. In the free tier, every single login request — whether legitimate or from a bot — reaches your web server, gets processed by PHP, hits the database, and then either proceeds or gets rejected. Under a distributed attack involving hundreds or thousands of IPs, this processing load accumulates. On shared hosting with limited CPU and memory, a sustained attack can visibly slow the entire site.

The premium cloud tier addresses this directly. Requests are intercepted in the cloud before reaching your server, so your hosting infrastructure sees only legitimate traffic. For sites on budget hosting or hosting with strict resource limits, this is not a trivial benefit — it can be the difference between surviving an attack and a site going down.

6. Practical Strengths

6.1 What LLAR Does Well

Based on research, user feedback across the WordPress community, and analysis of the plugin’s architecture, the following represent genuine strengths:

• Focused scope: LLAR does one thing and does it well. It is not trying to be a full security suite, an antivirus, a backup tool, and a firewall all at once. This focus means the plugin stays lean, understandable, and relatively low-risk to install.
• Breadth of endpoint coverage: Covering wp-login.php, XMLRPC, WooCommerce, and custom login pages by default removes a common gap that simpler implementations leave open.
• Progressive lockout logic: The two-tier lockout system — a short initial lockout followed by a much longer second lockout — is well-designed for discouraging persistent automated attacks without permanently inconveniencing legitimate users who make occasional mistakes.
• GDPR compliance option: The built-in GDPR notice and IP obfuscation feature is a meaningful addition for European site operators and anyone who wants to minimise the retention of personal data.
• Translation coverage: Available in 36 languages, which matters for international deployments.
• Longevity and track record: The plugin has been in active use and development for many years, with regular updates, compatibility fixes for new PHP versions, and a growing user base. Longevity in the security plugin space is itself a form of validation.
• Community-sourced threat intelligence in the premium tier: The crowdsourced IP database model, while not unique to LLAR, is genuinely valuable when the network is large enough. With 2.5 million active installations sharing data, the IP database grows meaningful over time.

7. Limitations and Weaknesses

No plugin review aimed at honest analysis can skip this section. LLAR has real limitations that should inform any purchase or deployment decision.

7.1 Not a Complete Security Solution

This is the most important limitation to understand. LLAR protects one attack vector — credential brute-forcing via the login page. It does nothing to protect against SQL injection, file upload vulnerabilities, plugin or theme exploits, malware injections, or any of the other attack categories that make up the majority of successful WordPress compromises. If you install LLAR and consider your site secured, you have addressed one narrow risk.

7.2 IP-Based Blocking Has Inherent Limitations

Blocking by IP address is an effective deterrent but not an absolute one. Sophisticated attackers use distributed botnets where each attempt comes from a different IP address. Against a botnet with thousands of nodes, IP-rate limiting becomes substantially less effective because each IP only ever makes one or two attempts — never enough to trigger a lockout. LLAR’s premium cloud intelligence helps here by cross-referencing known botnet IPs, but the free version has no defence against this pattern.

The reverse problem also exists: legitimate users on shared IPs — such as corporate networks where many employees share a single outbound IP — can trigger a lockout that affects all users on that network. The safelist feature helps if you know your organisation’s IP ranges, but many site owners do not think to configure this proactively.

7.3 Server-Side Processing Under Attack

As noted in the performance section, the free version cannot prevent attacking requests from consuming server resources. The attack is blocked at the application layer, not the network or infrastructure layer. For high-volume attacks this is a meaningful weakness that the free version fundamentally cannot address without the cloud infrastructure.

7.4 Premium Features Are Substantially Behind a Paywall

The jump between the free tier and the premium tier is significant. Country blocking, IP intelligence, auto-denylist, and the cloud admin unlock are all features that many site owners genuinely need — but they are only available on paid plans. The free version is useful but limited, and the Micro Cloud bridge is constrained enough that it should not be treated as a substitute for a proper paid plan on any site that sees regular attack traffic.

7.5 No Two-Factor Authentication

Two-factor authentication (2FA) is arguably the single most effective countermeasure against credential theft. Even if an attacker somehow obtains a correct username and password, 2FA stops them cold. LLAR offers no 2FA capability. If you want 2FA alongside login limiting, you need a separate plugin for that functionality.

7.6 No CAPTCHA Integration in the Free Version

CAPTCHA challenges add friction that specifically targets automated scripts. The free version of LLAR does not include CAPTCHA. Some competing plugins — including Loginizer and LoginPress — include CAPTCHA in their free or near-free tiers. LLAR’s lockout model is an alternative approach, but CAPTCHA would be a complementary layer of defence.

7.7 Email Notification Noise

With lockout notifications enabled by default since version 2.17, sites experiencing regular attack traffic — which is most publicly accessible WordPress sites — will receive frequent lockout emails. This is not a bug, but it creates alert fatigue. Many administrators end up disabling the notifications entirely rather than managing the volume, which removes useful visibility. A digest or threshold-based notification model would be an improvement.