Login Protection
Brute-force lockouts for wp-login and XML-RPC, plus username enumeration blocks.
What it does
Counts failed logins per IP, locks out after a threshold, optionally escalates duration, and can block REST user listing and ?author=N probes.
How it works
Manage allowlist and unlocks on the Login Protection tab. Thresholds and trusted proxies also appear under Settings.
Settings
Login thresholds, trusted proxies, enumeration block, and enable toggle — Settings and Login tabs.
Recommended action
Unlock yourself from another IP or via WP-CLI if locked out. Configure trusted proxies only when behind a reverse proxy you control.