Shieldlist

wp-login Free

WordPress password guessing — five failures in a minute, or eight in twelve hours

Category
web
Threshold
5/1m, 8/12h
Ban policy
web-auth
Report
wp-login-bruteforce
Parsers
wp-login-fail

Why it is written this way

WordPress password guessing, at either pace. Five refused logins
inside a minute is a script — a person mistypes twice, maybe three
times, then resets. Eight inside twelve hours is a machine pacing
itself to duck the fast figure — a person locks themselves out,
resets their password or walks away long before eight. One rule,
two rates (Robin, 2026-08-19: 5/1m and 8/12h): the first crossed
fires, on the same ladder — an hour ON THE WEB PORTS ONLY, so a
customer who does grind through five attempts loses the site for an
hour, not their mail, and climbs only if they come back. From
CrowdSec's http-bf-wordpress_bf (capacity 5, leakspeed 10s) and
wp-login-slow-bf (capacity 9, leakspeed 2h), tightened.

The rule file View raw

# WordPress password guessing, at either pace. Five refused logins
# inside a minute is a script — a person mistypes twice, maybe three
# times, then resets. Eight inside twelve hours is a machine pacing
# itself to duck the fast figure — a person locks themselves out,
# resets their password or walks away long before eight. One rule,
# two rates (Robin, 2026-08-19: 5/1m and 8/12h): the first crossed
# fires, on the same ladder — an hour ON THE WEB PORTS ONLY, so a
# customer who does grind through five attempts loses the site for an
# hour, not their mail, and climbs only if they come back. From
# CrowdSec's http-bf-wordpress_bf (capacity 5, leakspeed 10s) and
# wp-login-slow-bf (capacity 9, leakspeed 2h), tightened.
rule: wp-login
description: "WordPress password guessing — five failures in a minute, or eight in twelve hours"
category: web
parsers: wp-login-fail
threshold: [5/1m, 8/12h]
ban: web-auth
report: wp-login-bruteforce