WordPress brute force lockout not enough is a lesson security teams learn the hard way. Lockout handles single IP attackers cleanly. Distributed botnets defeat it. This guide explains the gap and the additional layers that close it in 2026.
The distributed attack gap
Lockout counts attempts per IP. Distributed botnets attack from thousands of IPs. Each IP makes one or two attempts then rotates. Per IP threshold never triggers. The attack proceeds.
This pattern is now the norm for serious attacks.
Per username lockout
Counting per username instead of per IP catches the distributed attack. After ten failed attempts on a specific username regardless of source IP, lockout the account. The attacker has to switch usernames.
Username enumeration defence matters here too. Without known usernames the attacker cannot target.
Two factor authentication
Even a guessed password fails without the second factor. Defyn Security Manager ships TOTP based 2FA that defeats distributed brute force regardless of attempt count.
the Defyn Security Manager plugin pairs naturally with lockout because the two defences cover different attack patterns.
URL hiding removes the target
Bots cannot brute force a URL they cannot find. URL hiding removes most distributed botnets from the equation before they can attempt anything.
The defence is cumulative.
Monitoring detects what defences miss
Audit logs show patterns. Unusual login attempt volume from many IPs over a short period signals distributed attack. The signal arrives even when the attack does not succeed.
Configure alerts so investigation can start early.
Frequently asked questions
Is wordpress brute force lockout not enough for small sites?
Lockout handles the volume small sites face. Pair with 2FA for resilience against targeted attempts.
Should I lockout by username?
Yes if the plugin supports it. Per username lockout catches distributed attacks per IP cannot.
Do I need a paid solution?
No. The layered defence above is achievable with free plugins.
Will heavy lockout policies hurt user experience?
A small fraction of legitimate users hit lockout occasionally. Documented unlock procedure keeps friction low.
Related reading
- Lockout thresholds
- Brute force anatomy
- Defyn Security Manager on WordPress.org – the plugin powering these techniques.
