Locked out of the login after failed attempts
Five failed attempts are enough, and then the login page turns your own address away. That is how the Security plugin slows down brute-force attempts — and now and then it hits the operator too. The block expires on its own and can additionally be lifted by hand.
How you recognize it
Instead of the usual error message, the login page shows: “Access temporarily blocked. Too many failed attempts from your address. Please try again in about X minute(s).” The number given is the time actually remaining. The activity log holds a matching entry with the address, the number of failed attempts, the block duration and the user name concerned.
Lift the block
- Sign in from a different connection — the block applies per IP address.
- Open the “Kakapo Security” entry in the WordPress menu.
- On the left, switch to “Login protection” (in German: „Login-Schutz“) in the “Protection” group.
- Look for the “Blocked IP addresses” table with the columns “IP address”, “Failed attempts” and “Blocked until”.
- Click on “Unblock” in the row concerned.
Adjust the limits
- “Login limit active” is switched on out of the box
- “Allowed failed attempts” — default 5, adjustable between 2 and 20
- “Block duration (minutes)” — default 15, adjustable between 1 and 1440; the same value is also the time window in which the failed attempts are counted
- Only failed attempts through the normal login form are counted; REST requests and application passwords are unaffected
- A successful sign-in empties the counter for that address
Further hurdles in front of the backend
If the “2FA globally active” switch is on under “Two-factor” (in German: „Zwei-Faktor“), the plugin asks for a six-digit code sent to the account email after the correct password — but only for accounts for which 2FA is switched on in the “Administrators” table. If no email arrives, the path ends there; for this the card lists the line “Email delivery (wp_mail)”. The code is valid for 10 minutes, and the associated messages read “Confirmation code expired. Please sign in again.” and “Too many failed attempts with the confirmation code. Please sign in again.”