Title: Protect Login Author: Simon Kraft Published: 22 août 2024 Last modified: 30 juin 2026 --- Recherche d’extensions ![](https://ps.w.org/protect-login/assets/icon.svg?rev=3297390) # Protect Login Par [Simon Kraft](https://profiles.wordpress.org/krafit/) [Télécharger](https://downloads.wordpress.org/plugin/protect-login.1.5.1.zip) [Prévisualisation en direct](https://fr.wordpress.org/plugins/protect-login/?preview=1) * [Détails](https://fr.wordpress.org/plugins/protect-login/#description) * [Avis](https://fr.wordpress.org/plugins/protect-login/#reviews) * [Installation](https://fr.wordpress.org/plugins/protect-login/#installation) * [Développement](https://fr.wordpress.org/plugins/protect-login/#developers) [Support](https://wordpress.org/support/plugin/protect-login/) ## Description Out of the box, WordPress will happily let anyone try to log in as often as they like. Type the wrong password a thousand times and it just shrugs and shows you the form again – which is exactly what someone running a brute-force script is counting on. _Protect Login_ closes that door. It started life as a fork of [Johan Eenfeldt](https://profiles.wordpress.org/johanee/)‘ s original _Limit Login Attempts_, a plugin a lot of us leaned on for years, and grew from there. #### It slows brute-force attacks to a crawl Protect Login watches failed logins per IP address. After a handful of wrong attempts that visitor has to wait before trying again, and if they keep guessing the wait grows. So a script built to try thousands of passwords ends up sitting on its hands. #### You decide who gets in, and who doesn’t Protect Login keeps a visible list of every address that’s currently locked out, right in the settings, and lets you release any of them with a single click. You can also keep an allowlist of addresses that skip the checks entirely (your office, your VPN’s exit node) and a blocklist of addresses that are turned away immediately. #### One login list, shared across all your sites If you look after more than one WordPress site – an agency, or just a small pile of your own projects — someone hammering one of them is often about to try the rest. Protect Login can link your sites together over its own Remote API: pick one site as the host, point the others at it with a URL and a key, and the block-, allow- and lockout-lists stay in sync across the lot. Block an address once and it’s blocked everywhere. #### And a few more things * Gets the real client IP right when your site sits behind a reverse proxy or CDN— direct and proxy modes * Speaks IPv6, not only IPv4 * Works on Multisite, applying settings and lists across the network. * Ships WP-CLI commands, so you can manage addresses and settings straight from the terminal. * Lets developers set everything in code via filters — and locks the matching field in the UI, so nobody ends up fighting their own filter. * Can enforce a minimum password strength for new passwords ## Installation 1. Upload the plugin files to the `/wp-content/plugins/protect-login` directory, or install the plugin through the WordPress plugins screen directly. 2. Activate the plugin through the « Plugins » screen in WordPress. 3. That’s it – sensible defaults are applied automatically. To change them, head to** Settings Protect Login**. ## FAQ ### Why did you build this? We care about WordPress and about keeping WordPress sites secure. So we took the code of the original Limit Login Attempts plugin and built on top of it. We did it for you: Protect Login is 100% free, with no nasty upsells and no scare marketing. You’ve got better things to do, haven’t you? ### Why don’t you reset failed attempts after a successful login? That’s very much on purpose. If we did, you could brute-force the « admin » password simply by logging in as your own user every fourth attempt — which would defeat the point. ### How do I know if my site is behind a reverse proxy? If you’re not sure, chances are it isn’t. A reverse proxy is a server that sits between your site and the internet – often handling caching or load-balancing – and it makes working out the correct client IP a little trickier. If you do use one, switch on proxy mode under **Settings Protect Login Advanced** and add your proxy’s IP or CIDR range to the trusted-proxies list, so a forwarded header can’t be spoofed. ### Can I put my own IP on an allowlist so I don’t get locked out? Yes. There’s an allowlist tab in Protect Login’s settings, and you can add your current address with a click. ### I locked myself out while testing. What now? Either wait until your account or IP is released, or — if you have FTP or SSH access— rename the `wp-content/plugins/protect-login` folder to switch the plugin off, log in, and rename it back. ### Do you support IPv6? Yes. As long as your web server passes an IPv6 address through to WordPress. ### Where do I report security bugs found in this plugin? Please report security bugs found in the source code of the Protect Login plugin through the [Patchstack Vulnerability Disclosure Program](https://patchstack.com/database/vdp/8f993618-835b-4951-ac1b-0efa35062d9b). The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin. ## Avis ![](https://secure.gravatar.com/avatar/823d95a3ad38ca50ecd87908c22e730d265ecf53fd36b6df57392880a1635da0? s=60&d=retro&r=g) ### 󠀁[Perfect](https://wordpress.org/support/topic/perfect-11034/)󠁿 [Manja Neumann](https://profiles.wordpress.org/tippl/) 19 août 2026 Clean pluging and easy to use ![](https://secure.gravatar.com/avatar/ebf24a46b59868038e2124a56a0d272ab24bb0731a0c1774763717f0ce403a6f? s=60&d=retro&r=g) ### 󠀁[The plugin makes a lean and clear impression!](https://wordpress.org/support/topic/the-plugin-makes-a-lean-and-clear-impression/)󠁿 [Michael](https://profiles.wordpress.org/michael-luther/) 20 novembre 2024 Compared to “Limit Login Attempts Reloaded”, it makes a lean and clear impression without any frills. PS: After several weeks of use, I can say that it works reliably on multiple websites. ![](https://secure.gravatar.com/avatar/5706550a5b705b844cfcacac6f96493d9184c0fe21b44d260df307e8de667a4e? s=60&d=retro&r=g) ### 󠀁[It does exactly what it should](https://wordpress.org/support/topic/it-does-exactly-what-it-should-4/)󠁿 [Jonas](https://profiles.wordpress.org/elbsegler/) 22 septembre 2024 It does exactly what it's supposed to.Thank you for this plugin. It's very nice not to be bombarded with ads. [ Lire les 2 avis ](https://wordpress.org/support/plugin/protect-login/reviews/) ## Contributeurs/contributrices & développeurs/développeuses « Protect Login » est un logiciel libre. Les personnes suivantes ont contribué à cette extension. Contributeurs * [ Simon Kraft ](https://profiles.wordpress.org/krafit/) * [ Thomas Günther ](https://profiles.wordpress.org/tidschi/) “Protect Login” a été traduit dans 1 locale. Remerciez [l’équipe de traduction](https://translate.wordpress.org/projects/wp-plugins/protect-login/contributors) pour ses contributions. [Traduisez « Protect Login » dans votre langue.](https://translate.wordpress.org/projects/wp-plugins/protect-login) ### Le développement vous intéresse ? [Parcourir le code](https://plugins.trac.wordpress.org/browser/protect-login/), consulter le [SVN dépôt](https://plugins.svn.wordpress.org/protect-login/), ou s’inscrire au [journal de développement](https://plugins.trac.wordpress.org/log/protect-login/) par [RSS](https://plugins.trac.wordpress.org/log/protect-login/?limit=100&mode=stop_on_copy&format=rss). ## Journal des modifications #### 1.5.1 * Bugfix: Typos * Bugfix: Fixed a fatal error (TypeError) during Remote API list synchronisation. * Bugfix: Fixed a fatal error that could occur in proxy (« client type ») mode when no valid forwarded address was present. * Bugfix: Fixed an « Array to string conversion » warning on the settings page when the dashboard-counter option had not been saved yet. * Improvement: Added « Trusted proxies » setting. In proxy mode the client IP is now only used when the request arrives via a configured trusted proxy. #### 1.5.0 * Tested with WordPress 7.0 * Bugfix: Removed an empty list item that appeared above the locked-out address counter in the « At a Glance » dashboard widget. * Bugfix: Locking out an IP address no longer clears all other active lockouts. * Bugfix: Remote API list synchronisation now runs as intended (the previous check never triggered a sync); local block-/allowlist entries are no longer lost when merging with remote lists. * Bugfix: Remote API calls now use the correct endpoint paths, so block, allow, release and list operations work against a paired site. * Bugfix: Lockout times in the settings list and WP-CLI output now use the site’s configured time zone instead of always showing UTC. * Bugfix: Corrected the swapped « your IP has (not) changed » message on the allowlist screen. * Bugfix: Reverse-proxy (« client type ») handling now works as configured, and falls back to the direct connection address when no valid forwarded address is present. * Bugfix: Hardened against division-by-zero and undefined-value notices when retry/ notification thresholds are set to 0 or no attempts have been recorded yet. * Bugfix: Activation and uninstall routines are now registered against the main plugin file so they run reliably. * Improvement: The settings override filters now work as documented. * Improvement: Removed an unnecessary PHP session start on every authentication and a redundant database write on every admin page load. * Improvement: Added `Text Domain` and `Domain Path` plugin headers and a translation template. * Development: Codebase migrated to new Coding Standard. ## Méta * Version **1.5.1** * Dernière mise à jour **il y a 4 mois** * Installations actives **700+** * Version de WordPress ** 5.7 ou plus ** * Testé jusqu’à **7.0.7** * Version de PHP ** 7.4 ou plus ** * Langues * [English (US)](https://wordpress.org/plugins/protect-login/) et [German](https://de.wordpress.org/plugins/protect-login/). * [Traduisez la dans votre langue](https://translate.wordpress.org/projects/wp-plugins/protect-login) * Étiquettes * [authentication](https://fr.wordpress.org/plugins/tags/authentication/)[login](https://fr.wordpress.org/plugins/tags/login/) [security](https://fr.wordpress.org/plugins/tags/security/) * [Vue avancée](https://fr.wordpress.org/plugins/protect-login/advanced/) ## Évaluations 5 sur 5 étoiles. * [ 3 avis à 5 étoiles ](https://wordpress.org/support/plugin/protect-login/reviews/?filter=5) * [ 0 avis à 4 étoile ](https://wordpress.org/support/plugin/protect-login/reviews/?filter=4) * [ 0 avis à 3 étoile ](https://wordpress.org/support/plugin/protect-login/reviews/?filter=3) * [ 0 avis à 2 étoile ](https://wordpress.org/support/plugin/protect-login/reviews/?filter=2) * [ 0 avis à 1 étoile ](https://wordpress.org/support/plugin/protect-login/reviews/?filter=1) [Votre avis](https://wordpress.org/support/plugin/protect-login/reviews/#new-post) [Tout voir](https://wordpress.org/support/plugin/protect-login/reviews/) ## Contributeurs * [ Simon Kraft ](https://profiles.wordpress.org/krafit/) * [ Thomas Günther ](https://profiles.wordpress.org/tidschi/) ## Support Demandes résolues ces deux derniers mois : 0 sur 1 [Voir le forum de support](https://wordpress.org/support/plugin/protect-login/)