Login protection: limit failed attempts per IP

Login protection counts failed sign-in attempts per IP address and rejects the address as soon as it has reached the limit you set. Only attempts through the normal login form are counted; requests via REST or with application passwords are unaffected. A successful sign-in clears the counter for that address again.

Setting the limit and the block duration

1. In the WordPress menu, open the “Kakapo Security” entry — with White Label active it carries the name set there — and choose the “Login protection” (in German: „Login-Schutz“) item in the left sidebar under “Protection”.
2. In the “Failed attempt limit” card, check the “Login limit active” switch; out of the box it is enabled.
3. Enter the value you want under “Permitted failed attempts”. 2 to 20 are allowed, the default is 5.
4. Set the time window under “Block duration (minutes)”. 1 to 1440 minutes are allowed, the default is 15.
5. Leave “Generic error message” switched on if the login screen is not to reveal whether the user name or the password was wrong.
6. Blocked addresses appear further down in the “Blocked IP addresses” card; the “Unblock” button lifts a block immediately.

How counting and blocking work

• The block duration is at the same time the counting window: if the first failed attempt was longer ago, counting starts again from the beginning.
• Once the limit is reached, the address is blocked for the same span and the sign-in is rejected before the password is even checked.
• The message at the blocked address gives the number of minutes remaining.
• For every block the table shows the address, the number of failed attempts and the time until which it applies.
• Every block is recorded as an event in the activity log and triggers an email, as long as the “Notify on IP block” switch is on under “Notifications” (in German: „Benachrichtigungen“).

Two more switches in the “More login hardening” card

• “Disable XML-RPC” switches the XML-RPC interface off. Out of the box the switch is off.
• “Block user enumeration” redirects calls with ?author=<id> to the home page for visitors who are not signed in and removes the REST route for user lists for anonymous visitors. Out of the box the switch is on.
• Signed-in requests keep the REST user route, so that connections via application password keep working.

kwpsec_trust_proxy