Description
Specifies the maximum number of wp-login.php and xmlrpc.php POST attempts allowed by an IP within 5 minutes before the action specified in Protection Mode is taken.
This limit is handled using a quota system where remaining attempts = limit. Each POST attempt will decrease the number of remaining attempts by 1, with the number of remaining attempts increasing back to the set limit over time. An IP will be throttled once the number of remaining attempts for that IP falls to 1/2 the set limit, throttling more as the remaining attempts drops further below the 1/2 mark. When remaining attempts reaches 0, the specified action is taken toward the IP.
In addition to this, if Enable reCAPTCHA is also enabled, an additional per worker protection will be added. If wp-login.php and xmlrpc.php are visited by the same worker at a rate of 4x the set limit in a 30 second time frame, those URLs will be put into reCAPTCHA mode until the number of visits to these files decreases.
Resetting the server will clear blocked IPs.
Default values:
Server-level: 10
VH-Level: Inherit Server level setting
Syntax
Valid Range: 3 - 1000.
Example
With an Attempt limit of 10, and a Mode of drop:
After the first POST attempt, the quota is decreased to 9.
Quota decreases by 1 for each POST attempt.
After Quota reaches half of the limit (5), the IP will be throttled.
Throttling will get worse with each POST attempt.
Once the quota reaches 0, the connection will be dropped.
Tips
Trusted IPs or sub-networks are not affected.
This setting will override Apache conf WordPressProtect setting for LSWS only. Apache will be unaffected.
This can be set at the Server level and overwritten at the Virtual Host level. If not overridden at the Virtual Host level, this setting can also be overridden in a user's docroot .htaccess file using Apache configuration directive WordPressProtect with integer value between 3 and 1000.