Shieldlist

wp-login Free

WordPress password guessing — three refused logins in a minute, or five in a day; the way sites get hijacked

Category
web
Threshold
3/1m, 5/24h
Ban policy
auth
Report
wp-login-bruteforce
Parsers
wp-login-fail wp-login-ok

Why it is written this way

WordPress password guessing, at either pace. Three refused logins
inside a minute is a script — a person mistypes twice, then resets.
Five inside a day is a machine pacing itself to duck the fast figure.
One rule, two rates (Robin, 2026-09-02: 3/1m and 5/24h — the second
day still showed hits far outnumbering bans at 4/1m-10/24h; a login
that works forgives three failures, so the honest customer keeps
their site, and an agency that fumbles five times pays an hour on
the web ports): the first crossed
fires, on the same ladder — an hour ON THE WEB PORTS ONLY, so a
customer who does grind through four attempts loses the site for an
hour, not their mail, and climbs only if they come back. From
CrowdSec's http-bf-wordpress_bf (capacity 5, leakspeed 10s) and
wp-login-slow-bf (capacity 9, leakspeed 2h), tightened.

A login that WORKS forgives three failures (2026-08-31): the person
who fumbles four times and then gets in is at their own door and
nets to one; a list being tried never logs in. The negative weight
makes the verdict wait out the lateness allowance — acceptable at
these windows, and wp-login-flood stays monotone for the fast case.

The rule file View raw

# WordPress password guessing, at either pace. Three refused logins
# inside a minute is a script — a person mistypes twice, then resets.
# Five inside a day is a machine pacing itself to duck the fast figure.
# One rule, two rates (Robin, 2026-09-02: 3/1m and 5/24h — the second
# day still showed hits far outnumbering bans at 4/1m-10/24h; a login
# that works forgives three failures, so the honest customer keeps
# their site, and an agency that fumbles five times pays an hour on
# the web ports): the first crossed
# fires, on the same ladder — an hour ON THE WEB PORTS ONLY, so a
# customer who does grind through four attempts loses the site for an
# hour, not their mail, and climbs only if they come back. From
# CrowdSec's http-bf-wordpress_bf (capacity 5, leakspeed 10s) and
# wp-login-slow-bf (capacity 9, leakspeed 2h), tightened.
#
# A login that WORKS forgives three failures (2026-08-31): the person
# who fumbles four times and then gets in is at their own door and
# nets to one; a list being tried never logs in. The negative weight
# makes the verdict wait out the lateness allowance — acceptable at
# these windows, and wp-login-flood stays monotone for the fast case.
rule: wp-login
description: "WordPress password guessing — three refused logins in a minute, or five in a day; the way sites get hijacked"
about:
  purpose: >-
    Stop WordPress password guessing before it finds an editor's account.
  blocks: >-
    Three refused logins in a minute, or five in a day, from one address.
  applies_to: >-
    Any site running WordPress, behind nginx or Apache.
  requires:
    - >-
      The site's access log in combined format, declared as `log: http`.
  beware:
    - >-
      An editor who has forgotten their password reaches three in a minute easily. The ban is on the web ports and lasts an hour to begin with, which is the right size for that mistake.
category: web
parsers:
  - parser: wp-login-fail
    weight: 1
  - parser: wp-login-ok
    weight: -3
threshold: [3/1m, 5/24h]
ban: auth
report: wp-login-bruteforce