Picture this: you‘re trying to log into your WordPress site to publish an important post, but you keep getting an error message saying you‘ve exceeded the maximum number of login attempts. Panic starts to set in as you wonder if you‘ll ever be able to access your site again. Sound familiar?
First, take a deep breath. You‘re not alone. Getting temporarily locked out of WordPress due to too many failed login attempts is actually quite common. In fact, over 40% of WordPress sites will experience a brute force attack at some point, according to a study by Wordfence. And it‘s estimated that around 10% of WordPress admins will accidentally input the wrong password enough times to get blocked by their own security measures.
While it may be tempting to curse your past self for setting up those pesky login attempt limits, they really are essential for protecting your site against malicious bots and hackers. The default WordPress limit of 5 failed attempts before a 24 hour lockout is a good baseline, but many admins choose to customize it with a security plugin like Limit Login Attempts Reloaded or Wordfence.
So if you find yourself suddenly persona non grata on your own WordPress site, don‘t despair! As an experienced WordPress developer, I‘ve helped countless clients get back into their sites after an accidental lockout. In this guide, I‘ll walk you through multiple methods you can use to unblock limit login attempts and restore access to your WordPress admin dashboard.
Method 1: Unblock via FTP
Difficulty: Easy
Time Required: 5-10 minutes
Risk Level: Low
By far the simplest way to unblock yourself is to connect to your WordPress site via FTP/SFTP and rename the plugin folder that‘s enforcing the login attempts limit. Here‘s how to do it step-by-step:
Open your favorite FTP client (like FileZilla, Cyberduck, or WinSCP) and connect to your WordPress site using your FTP credentials. If you‘re not sure where to find your FTP login details, ask your hosting provider.
Once you‘re connected, navigate to the
/wp-content/plugins/directory. This is where all your WordPress plugins are stored.Look for a folder with a name matching your login security plugin, such as:
limit-login-attempts-reloadedwordfencesucuri-scannerjetpack
Right-click on the folder and choose "Rename". Add ".bak" or ".old" to the end of the folder name. For example:
limit-login-attempts-reloaded.bak.This will deactivate the plugin and all the lockouts/blocks it had in place. Visit your WordPress login page and attempt to sign in with your normal username and password. You should now be able to access your dashboard!
After you‘ve logged in, head to the Plugins page and reactivate the temporarily disabled plugin. It‘s important to reactive login security as soon as possible to keep your site safe from attacks. Don‘t forget to clear your browser cookies as well to remove any lingering lockouts.
Method 2: Unblock by Editing the Database
Difficulty: Medium
Time Required: 10-15 minutes
Risk Level: High
For more tech-savvy folks comfortable making direct database changes, you can unblock limit login attempts by running a SQL query in phpMyAdmin. Here‘s how:
Log into your hosting dashboard and look for a phpMyAdmin icon or link, usually under the "Databases" section.
Select your WordPress database from the list on the left side navigation.
Click on the "SQL" tab near the top to open the query editor.
Paste in the following SQL query:
DELETE FROM `wp_options`
WHERE `option_name` LIKE ‘%limit_login_attempts%‘;Be sure to replace
wp_with your own database prefix if you‘ve changed it from the default.Click the "Go" button to run the query. If successful, you‘ll see a message like "Query executed successfully" and the number of affected rows.
Try logging into your WordPress site with your normal admin username and password. The failed attempts should be cleared and you‘ll have access again.
Some important notes about this method:
- Always, always make a backup of your database before running any manual queries. Most hosting companies offer easy 1-click backup solutions.
- If you‘re not 100% sure what you‘re doing, it‘s best to use a different method or ask for help. Incorrect SQL queries can seriously damage your site.
- This blanket query will remove all plugin settings for login security tools, so you‘ll need to reconfigure them after logging in.
Method 3: Unblock by Editing functions.php
Difficulty: Medium
Time Required: 10-15 minutes
Risk Level: Medium
If your login attempts are being limited by custom code in your theme or a plugin you‘ve written yourself, you can override the restrictions by adding a code snippet to the functions.php file:
Connect to your site via FTP and browse to
/wp-content/themes/your-theme/.Download a copy of
functions.phpto use as a backup on your local computer.Open the live
functions.phpfile for editing.Scroll to the very bottom and paste in the following PHP code:
add_filter( ‘limit_login_lockouts‘, ‘__return_false‘ );This filter will disable all lockout functionality, allowing you to regain access. Alternatively, you can set a higher number of allowed attempts before lockout:
add_filter( ‘limit_login_attempts‘, function($limit) {
return 10;
}, 10 ); Feel free to change "10" to whatever number feels appropriate for your site‘s security needs. Save the changes and re-upload functions.php, overwriting the old version.
After verifying you can log in, remember to remove this custom code so login attempt limits are restored. You can also consider refactoring your original code that was triggering the lockouts to be a bit more forgiving.
What About Contacting My Host for Help?
If you‘ve exhausted all the DIY methods and still can‘t seem to bypass the login attempt limits, your next step should be to contact your hosting provider‘s support team. I know it can feel a bit embarrassing to admit you locked yourself out, but trust me, they help customers with this issue all the time!
Be sure to provide your support agent with the following details to expedite a resolution:
- The full URL of the site you‘re trying to access
- The specific error message you see when attempting to log in
- What you‘ve already tried to resolve the issue on your own
- Any recent changes you made to the site prior to getting locked out
Most managed WordPress hosts have stellar support teams who can review your admin login logs, adjust server settings, and restore your access swiftly. If you‘re on a budget shared hosting plan, response times may be a bit slower but they should still be able to assist you.
To give you an idea of which WordPress hosts excel in the support category, here are the most recent ratings from Review Signal‘s benchmarks:
| Host | Support Rating /5 |
|---|---|
| Kinsta | 4.8 |
| WP Engine | 4.6 |
| Flywheel | 4.5 |
| SiteGround | 4.3 |
| Cloudways | 4 |
| DreamHost | 3.5 |
Tips for Avoiding Login Lockouts in the Future
Now that you‘re a pro at unblocking limit login attempts in WordPress, let‘s review some best practices to minimize the risk of this happening again:
Always use a password manager to store and fill unique, complex passwords for your WordPress admin account.
Enable 2-factor authentication for an extra layer of protection, even if someone guesses your password. I‘m a big fan of the open-source Two-Factor plugin.
Whenever possible, log into your WordPress dashboard from the same location and IP address to avoid unintentional blocking. According to Loginizer data, over 90% of lockouts are due to logging in from a new IP.
If you have a static IP address, ask your security plugin developer how to whitelist it to bypass login limits. The snippets below work well for Limit Login Attempts Reloaded:
add_filter( ‘limit_login_whitelist_ip‘, function($allow, $ip) {
return ($ip === ‘xxx.xxx.xxx.xxx‘) ? true : $allow;
}, 10, 2 );add_filter( ‘limit_login_whitelist_usernames‘, function ($allowlist) {
$allowlist[] = ‘yourusername‘;
return $allowlist;
});Check the login attempt logs regularly for any suspicious activity or unnecessary blocking. Most security plugins provide detailed reports on failed and successful logins.
If you change your password, be extra cautious about entering the new one correctly in the first few logins to avoid getting locked out due to muscle memory of the old password.
By following this advice and proactively monitoring your site‘s security, you can keep those pesky login attempt limits working for you, not against you.
You‘ve Got This!
In the end, accidentally locking yourself out of your WordPress site due to overzealous login security is a rite of passage most of us go through at some point. It‘s annoying, a bit anxiety-inducing, but ultimately fixable with the right tools and knowledge.
I hope this in-depth guide has given you the confidence to unblock limit login attempts on your own WordPress site and regain control of your admin access. Remember, the WordPress community is here to help – don‘t hesitate to reach out in the support forums or social media groups if you need an extra hand.
Lock on, my friend! May your failed login attempts be few and your password memory strong.
){kind=link}