Brute force protection plugins have a smaller job than they used to. Most login-guessing traffic hitting your WordPress site should never reach PHP at all. Your CDN or your host should drop it at the edge, before WordPress boots. That changes which plugin you need, and whether you need one at all. Below: what still earns a slot, what each one costs, and the names this list used to recommend that we have now cut.
Quick verdict
- Best overall: Wordfence Security, and specifically the free version. Rate limiting, login throttling and a real attack log, without a licence.
- Best free and simplest: Limit Login Attempts Security. Lockouts, logs and alerts, nothing else, and no upsell to a scanner you did not ask for.
- Best set-and-forget: Jetpack. Brute force protection is in its free tier and runs against a shared blocklist, so there is nothing to tune.
- Skip a plugin entirely if: your host or CDN already rate limits
/wp-login.phpand/xmlrpc.php. Adding a second lockout layer on top of that buys you a log file, not protection. - Our call: fix the edge first, then install Wordfence free for visibility. Paying for brute force protection specifically is close to the last upgrade we would recommend on a small site.
Start at the edge, not in wp-admin
WordPress’s own advanced administration documentation no longer leads with plugins for this. Its brute force guidance says to prefer edge-level WAF, 2FA, passkeys and targeted rate limiting, and it explains why: traffic blocked at the edge is, in its words, blocked “before reaching your server, preserving resources during high-volume attacks.”
That last part is the whole argument. A plugin cannot block a request until WordPress has already loaded PHP, connected to MySQL and run through the plugin stack to reach the lockout check. Ten thousand blocked login attempts still cost you ten thousand PHP processes. That is why a sustained login flood shows up as a slow site rather than a hacked one, and why the fix belongs in the same conversation as server response time rather than in the security plugin menu.
Before you install anything, check what you already pay for. Cloudflare’s free plan is thinner than most people assume. Its rate limiting rules documentation allows one rule on Free, two on Pro, five on Business and one hundred on Enterprise. Its managed rules documentation gives Free only the Free Managed Ruleset; the Cloudflare Managed Ruleset, the OWASP Core Ruleset and Exposed Credentials Check all start at Pro.
One rule is enough, though. Point it at /wp-login.php, cap it at five requests a minute per IP, and you have removed the reason most of these plugins exist. Managed hosts often do the equivalent at the load balancer without advertising it, so ask support before you buy anything. It is a real differentiator between WordPress hosting platforms and worth a note when you are choosing a host.
Everything below is what to do after that, or instead of it when you have no edge to work with.
Brute force protection plugins compared
| Plugin | Free version | Cheapest plan with these features | Renews at | Currency served |
|---|---|---|---|---|
| Wordfence Security | Yes, full login rate limiting | Premium, price not quoted here | Not verified | Not verified |
| Limit Login Attempts Security | Yes, lockouts and logs | Premium, 4,960 per year | Not stated | INR |
| Loginizer | Yes, lockouts and 2FA | Personal, 24 per year | Not stated | USD |
| Kadence Security | Yes, lockouts and 2FA | Kadence Pro bundle, 299 per year | Not stated | USD |
| Jetpack | Yes, brute force protection included | Security, 584.95 per month billed yearly | 1,171.95 per month | INR |
| Sucuri | Yes, scanner and hardening only | Basic Firewall, 9.99 per month per site | Not stated | USD |
| WP Ghost | Yes, path hiding and basic firewall | Ghost 1, 23.99 per year | Same price, per the vendor | USD |
Two things fall out of that table. Of the prices quoted in dollars, the two cheapest paid licences are WP Ghost’s Ghost 1 at $23.99 per year and Loginizer Personal at $24 per year, and the WP Ghost figure is a discount off a $29 list price. The most expensive of these is Kadence Pro at $299 per year, and that is a full theme-and-blocks bundle rather than a security product.
Wordfence Security
Wordfence is the default answer, and it deserves to be, mostly because its free tier is not crippled. Login rate limiting, lockouts after a set number of failures, blocking of known-breached passwords, two-factor authentication and a live traffic view are all in the free plugin. The WordPress.org listing shows 5 million or more active installations and version 9.0.0 last updated in August 2026, so it is not going anywhere.
Key features: failed-login and forgot-password rate limits, immediate lockout for invalid usernames, IP and country blocking, breached-password enforcement, 2FA for any role, and an attack log that tells you which IPs are actually hammering you rather than just how many.
Price: free tier covers everything in this article. Premium adds real-time rule and IP blocklist updates, which matter for malware rules more than for brute force. Wordfence’s pricing pages did not return readable content at the check date, so we are not quoting a figure; check it at checkout.
Best for: anyone who wants one plugin, wants it free, and wants to be able to see what hit them last Tuesday.
Skip it if: your server is memory-constrained. Wordfence runs on your server rather than in front of it, and it ships far more than login protection: live traffic logging, a malware scanner and a firewall, all executing in PHP. On cheap shared hosting the traffic table and the scanner are what push you into swap. The honest fix there is more headroom, not a lighter security plugin, so you may need to raise the WordPress memory limit first.
Limit Login Attempts Security
This is the one we install on client sites that already have edge protection and just need an application-layer backstop. Note the rename: the plugin most people still call Limit Login Attempts Reloaded now ships as Limit Login Attempts Security. The WordPress.org listing shows 1 million or more active installs, version 3.3.5, and a 4.8 rating across roughly 1,478 reviews.
Key features: configurable retry and lockout windows, safelist and denylist by IP or username, a lockout log, email alerts, and GDPR-conscious handling of the IP addresses it stores. That last point matters more than it sounds if you have European visitors and a GDPR compliance setup to keep honest.
Price: free tier is genuinely enough. The vendor’s plans page geo-switches currency and quoted Indian rupees at the check date: Premium at 499.99 per month or 4,960 per year, Premium Plus at 6,850 per year and Professional at 9,950 per year, all per domain, with lifetime options. Paid tiers add cloud IP intelligence, country blocking and a login firewall.
Best for: sites where the edge does the heavy lifting and you want a small, boring plugin behind it.
Skip it if: you want malware scanning or file integrity checks. It does not do them and does not pretend to. Pair it with something from our roundup of malware removal plugins if that is the gap.
Loginizer
Loginizer works out of the box. Activate it and the default retry limits are already sane, which is the opposite of most security plugins and a real advantage if you hand sites to clients. Its WordPress.org listing shows 1 million or more active installs, version 2.1.0, and a 4.8 rating from roughly 1,030 reviews.
Key features: retry limits with escalating lockouts, IP allowlist and blocklist, blocking by IP range, and email alerts. The free version also includes two-factor authentication, which is unusually generous. Paid tiers add passwordless login, reCAPTCHA, a challenge question and social login.
Price: the free version is on WordPress.org. The Loginizer pricing page quoted dollars: Personal at $24 per year, Blogger at $40, Professional at $90 and Business at $150, plus a pay-as-you-go agency tier. The page does not state a separate renewal price.
Best for: handovers. If someone else is going to own this site and will never open the settings page, Loginizer’s defaults are the safest bet on this list.
Skip it if: you want deep logs. Loginizer tells you an IP was blocked. Wordfence tells you what it asked for, in what order, with what user agent. For incident work that difference is everything.
Kadence Security, formerly iThemes Security and Solid Security
This plugin has had four names. It launched as Better WP Security, became iThemes Security, then Solid Security, and now ships as Kadence Security. The WordPress.org listing still lives at the better-wp-security slug and shows 700,000 or more active installs, version 10.0.3, and a 4.6 rating from roughly 3,990 reviews, a chunk of which are people complaining about the rebrand rather than the software.
Key features: login lockouts, network-wide ban lists, 2FA including app and email methods, passkey support, forced password resets, file change detection, and a hardening checklist that is still the friendliest onboarding of any security plugin.
Price: free on WordPress.org. The paid side is where it stings. The Kadence pricing page lists Essentials at $99 per year, Pro at $299 and Elite at $499, and it puts the security firewall, 2FA and virtual patching in Pro and Elite. There is no security-only plan on that page any more, so the premium features now arrive attached to a theme and blocks bundle you may not want.
Best for: people already buying into the Kadence ecosystem, where the security features are a bonus rather than the purchase.
Skip it if: you only want the security half. Paying $299 a year for a bundle to get a login firewall is poor value when Wordfence gives you an equivalent for nothing. The free version remains a fine pick.
Jetpack
Jetpack’s brute force protection is the most overlooked useful thing on this list, because it is buried inside a plugin people install for other reasons. It works differently from everything else here: instead of counting failures on your site alone, it checks logins against a blocklist built from attacks across the whole Jetpack network. An IP that just failed on someone else’s site arrives at yours already known.
Key features: shared-network IP blocklist, an allowlist for your own addresses, and no settings to tune. It is on by default once Jetpack is connected.
Price: brute force protection is in the free plan. That is the headline. The paid tiers on Jetpack’s pricing page are for backups, malware scanning and search, and the page geo-switches currency; it quoted Indian rupees at the check date, with the Security plan at 584.95 per month billed yearly for the first year and renewing at 1,171.95 per month. If backups are the actual gap, compare it against dedicated WordPress backup plugins before you subscribe.
Best for: sites already running Jetpack, and anyone who wants zero configuration.
Skip it if: you do not want a WordPress.com connection. Jetpack requires one, and installing an entire suite for one feature is a lot of code for a job a single-purpose plugin does. There is also no lockout log worth the name, so when a client asks who tried to log in, you have nothing to show them.
Sucuri
Sucuri is the one entry here where the free plugin is not the product. The WordPress.org plugin scans, monitors file integrity and applies hardening. The brute force blocking lives in Sucuri’s cloud firewall, which sits in front of your site and changes your DNS, so it stops login floods before they reach your server in exactly the way the plugins above cannot.
Key features: a proxying WAF with its own CDN, login page protection including optional two-factor at the firewall level, IP allowlisting for wp-admin, malware cleanup by human analysts, and post-hack blacklist removal.
Price: from Sucuri’s platform page, the firewall on its own is $9.99 per month per site, or $19.98 for the Pro firewall. The full platform plans, which bundle unlimited malware cleanups and faster response times, are $229, $339 and $549 per year for Basic, Pro and Business. Worth doing the multiplication: the Basic Firewall works out at $119.88 a year, roughly half the $229 Basic Platform, and the firewall is the part that stops brute force.
Best for: sites with no CDN and no host WAF, where you want someone else to own the edge. Also the right call if you have already been hacked and need cleanup, not prevention.
Skip it if: you already run Cloudflare. You would be stacking two reverse proxies to solve one problem, and the DNS change makes rollback annoying at exactly the moment you want it to be easy.
WP Ghost, formerly Hide My WP Ghost
WP Ghost takes a different route: rather than counting failed logins, it moves the login URL and rewrites the paths that give WordPress away. Bots hitting /wp-login.php get a 404 and move on. The WordPress.org listing shows 100,000 or more active installs, version 7.0.09 updated in August 2026, and a 4.5 rating from roughly 372 reviews.
Be clear-eyed about what this is. Moving the login URL is obscurity, not security. It stops the dumb scripted traffic that makes up most login floods, which does cut server load, and it does nothing against anyone who bothers to fingerprint your site properly. Run it alongside a lockout, not instead of one.
Key features: custom login URL, path and asset URL rewriting, a firewall layer, brute force lockouts, and blocking of the usual reconnaissance endpoints including /xmlrpc.php and author enumeration by ID.
Price: free version on WordPress.org. WP Ghost’s pricing page quoted dollars: Ghost 1 at $23.99 per year for one site, discounted from $29, Ghost 5 at $52.50 for five and Ghost All at $192 for up to a thousand. The vendor states that renewals are at the same price, and lifetime licences start at $180 for five sites. Prices exclude local tax.
Best for: sites getting hammered on the login page where you cannot change the edge, and cheap multi-site licences for a small agency portfolio.
Skip it if: you use visual page builders or membership plugins with hardcoded admin-ajax paths. Path rewriting is the single most common cause of a site that suddenly breaks after a security plugin install. Test on staging, and have a restore point ready before you turn it on.
What we cut from this list, and why
Three names that appear on nearly every list of brute force protection plugins are gone from ours.
- WP Cerber Security. Its WordPress.org page now shows a closure notice giving a security issue as the reason, and the plugin is not available for download there. The developer distributes it from their own repository instead. That may be fine for you, but a plugin you cannot install or auto-update through WordPress.org is not a default recommendation.
- Security Ninja. Actively maintained, with version 5.300 updated in August 2026, but its listing shows only 7,000 or more active installs. Its pricing page returned a 403 at the check date, so no price is quoted. Small install base plus unverifiable pricing is not a combination we will recommend to a stranger.
- Google Authenticator and other 2FA plugins. They are good and you should probably run one, but they do a different job. A second factor stops a correct password from being enough; it does not stop the flood of guesses. That is a separate purchase decision, covered in our two-factor authentication plugins roundup.
What most roundups get wrong about brute force protection
A lockout is a denial-of-service switch you handed to strangers
Lock an account after five failures and anyone who knows a username can lock that account out on demand. On a membership or WooCommerce site with real customer accounts, this is not theoretical: it becomes a support ticket queue. Lock by IP rather than by username where the plugin lets you, and never enable username-based lockouts on a site with public registration.
Blocked is not the same as free
Every one of these plugins reports how many attacks it blocked. None of them mention that each blocked attempt still ran PHP, still opened a database connection and still consumed a worker. A plugin turning away 50,000 requests a day is describing a load problem, not solving one. That number is the argument for moving the block to the edge, not evidence that you do not need to.
The login form is not the only door
XML-RPC accepts credentials too, and system.multicall historically let an attacker test many passwords in a single request, which sails past any per-request counter. The REST API and application passwords are another path. If your plugin only watches wp-login.php, check what it does with the rest. WordPress’s own guidance is to scope rate limiting to both /wp-login.php and /xmlrpc.php.
This corner of the market churns, and it costs you
In the space of a few years the iThemes plugin became Solid Security and then Kadence Security while its paid features moved into a bundle, Limit Login Attempts Reloaded was renamed, WP Cerber left WordPress.org entirely, and Hide My WP Ghost became WP Ghost. If you are picking a security plugin to leave running unattended on a client site for five years, weight the boring, widely installed option heavily. Continuity is a feature.
Most of what gets called a brute force attack is credential stuffing
Attackers are rarely guessing at random. They are replaying username and password pairs from other services’ breaches, often one attempt per account, which never trips a retry counter. The defence there is not a lockout. It is blocking known-breached passwords and requiring a second factor. Wordfence’s free tier does the first; a 2FA plugin does the second.
Which one should you install?
- You have Cloudflare or a managed host WAF. Write the rate limiting rule first. Then add Limit Login Attempts Security as a backstop and stop there.
- You have neither, and no budget. Wordfence free. Turn on the login rate limits, enable 2FA for admins, and leave the scanner on a weekly schedule so it does not eat your CPU.
- You have neither, and a budget. Sucuri’s firewall at $9.99 a month buys you the edge you are missing, which is a better use of the money than any premium plugin licence on this list.
- You are handing the site to a non-technical owner. Loginizer, for the defaults, or Jetpack if they are already connected to WordPress.com.
- Your login page is being hammered right now. WP Ghost’s custom login URL will stop the noise today. Test it on staging first, then go and fix the edge properly this week.
Whichever you pick, it is one layer. The rest of the stack, from file permissions to update discipline, is covered in our wider guide to WordPress security plugins, and the same bots that guess passwords also flood comment forms, which is a job for anti-spam plugins instead.
Frequently Asked Questions
Is a brute force protection plugin still necessary?
Only if nothing in front of your site is already rate limiting the login page. Check with your host first. If your CDN or host WAF caps requests to wp-login.php, a plugin adds a log and a second opinion, not real protection. Free plugins are still worth it for the visibility.
Is the free version of Wordfence enough?
For brute force, yes. Login rate limiting, lockouts, breached-password blocking, two-factor authentication and the attack log are all in the free plugin. Premium mainly buys faster malware rule updates, which matters for vulnerability scanning rather than for stopping password guessing.
Can you run two security plugins at once?
You can, but lockout plugins fight. Two of them counting the same failed logins produces double bans, contradictory logs and unpredictable unlock windows. Pick one plugin for login protection. Running it alongside a separate scanner or a cloud firewall is fine, since they work at different layers.
Does changing the login URL actually work?
It works against scripted bots, which are most of your traffic, and it does nothing against a targeted attacker. Treat it as load reduction rather than security. WP Ghost does this well, but keep a lockout running underneath it and test with your page builder before going live.
What happened to iThemes Security and Solid Security?
Same plugin, new name. It shipped as Better WP Security, then iThemes Security, then Solid Security, and now Kadence Security. The free version is still on WordPress.org under the better-wp-security slug. The paid security features now sit inside the wider Kadence bundles rather than a standalone licence.
Why is WP Cerber missing from this list?
Its WordPress.org page carries a closure notice citing a security issue, and the plugin cannot be downloaded there. The developer now ships it from their own repository. That is workable if you already use it, but a plugin outside WordPress.org update channels is not a default recommendation for most sites.
Will a lockout plugin lock you out of your own site?
It can, and the fix is planning. Add your own IP to the allowlist before you tighten anything, know how to rename the plugin folder over SFTP or disable it in the database, and never set a lockout window longer than you are willing to wait.
Does two-factor authentication replace brute force protection?
No, they solve different halves. A second factor means a correct password is not enough to get in, so it stops the attack succeeding. It does not stop the guessing traffic arriving, so your server still pays for every attempt. Run both, and put the rate limit at the edge.
Our call
Install Wordfence free, then spend the hour you saved writing one rate limiting rule at your CDN. For a site under a few thousand visits a day that combination beats every paid licence in this article, and it costs nothing.
If you have no edge to work with, Sucuri’s firewall at $9.99 a month per site is a better purchase than any premium plugin here, because it is the only option on this list that stops the traffic before your server sees it.
And if you take one thing from this: the number your security plugin proudly reports as attacks blocked is a hosting bill, not a trophy. Move that block upstream.
[…] anything. If your traffic is mostly hitting wp-login.php rather than your comment form, you want brute force protection plugins […]
[…] not sell to. It complements rather than replaces a proper security plugin, and pairs sensibly with brute force protection on […]
[…] you have not tightened logins yet, do that before you add code execution. Our brute force protection plugins comparison covers the login layer, and the broader WordPress security plugins roundup covers what […]