“Too many failed login attempts”

The message comes from a security plugin that counts failed logins, and this exact wording is from Limit Login Attempts Reloaded. WordPress itself doesn't limit login attempts. When someone types the wrong password too many times, the plugin blocks the IP address the attempts came from. Some plugins lock the user account instead.

In an office, everyone on the same network shares one public IP address. If one colleague has forgotten the password and tries four or five, the whole office is locked out.

With the default settings, the IP address is blocked for 20 minutes. After that you can log in normally. If you can't wait, or if it keeps happening, the fixes are below.

See how long you have to wait

The message tells you how long to wait, for example "ERROR: Too many failed login attempts. Please try again in 20 minutes."

With the default settings in Limit Login Attempts Reloaded:

• After four failed attempts, the IP address is blocked for 20 minutes.
• Once the address has been blocked four times, the next block lasts 24 hours.

Whoever set up the plugin may have changed these numbers.

Wordfence works the same way, but shows its own page headed "Your access to this site has been temporarily limited by the site owner". With the default settings, the IP address is blocked for four hours after 20 failed attempts.

Log in from another IP address

If your IP address is blocked, you can log in from another network.

1. Turn off Wi-Fi on your phone and open the login page over mobile data.
2. Log in if you're sure of the password.
3. If you aren't sure, press "Lost your password?" instead of guessing. Every failed attempt counts, and the more often you're blocked, the longer it lasts.

If the plugin has locked the user account itself, changing networks doesn't help. Another administrator will then have to unlock the account in the security plugin's settings, or you have to turn the plugin off as described below.

Deactivate the plugin over FTP

If you can't wait, deactivate the plugin temporarily.

1. Connect with FTP or the file manager in your hosting panel and open wp-content/plugins.
2. Rename the limit-login-attempts-reloaded folder, for example to limit-login-attempts-reloaded-off.
3. Log in to wp-admin.
4. Rename the folder back to limit-login-attempts-reloaded, and check under Plugins that the plugin is active.
5. Add your IP address to the plugin's allowlist in its settings. You can find your IP address at whatsmyip.org. Remember that your home or office IP address can change.

With Wordfence, the lockout page has a field where administrators can enter their email address and click "Send Unlock Email". The email contains a link that lifts the block. If it doesn't arrive, rename the wordfence folder the same way.

If it keeps happening

Either you and your colleagues are triggering the lockouts, or bots are.

If you and your colleagues keep getting locked out, someone is guessing a forgotten password, or a browser is filling in an old one. Add the office IP address to the security plugin's allowlist, so the whole office isn't locked out next time. Ask everyone to press "Lost your password?" instead of guessing, and consider a password manager, so fewer people forget their password.

If you get notifications that many unknown IP addresses are being blocked, it's bots. They collect email addresses from contact pages and elsewhere on the web. WordPress accepts the email address as a username, so the bots then try thousands of passwords with those addresses on the login page. This is called a brute force attack.

1. Put the site behind Cloudflare, and create a custom WAF rule that sends every request for wp-login.php through a Managed Challenge. Cloudflare then stops the bots before they reach the server.
2. Move the login page to another address, for example with the WPS Hide Login plugin. Bots that look for wp-login.php only get an error page.
3. Use strong passwords and turn on two-factor authentication, so an email address alone isn't enough to log in.

The article about bots hammering the login goes through this in more detail.

Still locked out?

Without FTP access or another network to log in from, you have to wait for the block to expire or ask whoever runs the site to lift it.