WordPress brute force lockout thresholds decide how strict your defence is. Too lax and attacks slip through. Too strict and your own team gets locked out. This guide covers the values that balance defence and usability in 2026.
Why thresholds matter
Lockout works by counting failed attempts and blocking after a threshold. Set the threshold too high and brute force succeeds. Set it too low and your team gets locked out when they fat finger their password.
The right values depend on team size and attack history.
Sensible defaults
Five failed attempts within fifteen minutes triggers a thirty minute lockout. For most small teams these defaults work without complaint. Adjust based on actual usage patterns over the first month.
Start with defaults. Tune later.
When to tune
Frequent team lockouts mean threshold too low. Increase the attempt count or shorten the window. Frequent successful brute force attempts mean threshold too high. Decrease the attempt count or lengthen the window.
Look at the audit log monthly to decide.
Clearing active lockouts
Defyn Security Manager provides one click clear from settings. Restoring a locked out staff member takes seconds. the Defyn Security Manager plugin also logs each lockout so you know who and from where.
Document the clear procedure so any administrator can help a locked out colleague.
Pair with other defences
Lockout alone slows attacks. Combined with URL hiding and 2FA, lockout makes successful attacks nearly impossible. Lockout is the second layer in defence in depth.
Layered defence beats single layer thick defence.
Frequently asked questions
What wordpress brute force lockout thresholds are most common?
Five attempts in fifteen minutes triggering thirty minute lockout is standard.
Should lockouts persist across reboots?
Yes. Persistence prevents bot retry strategies that wait out short term blocks.
Will lockouts affect SEO?
No. Bots that hit lockout do not affect Google crawlers, which never log in.
Can I whitelist my own IP from lockout?
Yes. Settings support exceptions.
Related reading
- Brute force anatomy
- Login security checklist
- Defyn Security Manager on WordPress.org – the plugin powering these techniques.
