“login-limiter”

SecurityKit: opt-in WordPress hardening toolkit: security headers, XML-RPC and user-enumeration limits, login limiter, activity log, alerts and a security score.

Limits login attempts with IP and username management

One-click WordPress hardening plugin: security headers, XML-RPC off, enumeration blocked, login limiter. One small readable file.

WordPress-native brute-force protection: per-IP failed-login lockouts with allow-list and lockout log