Limit Login Attempts

This is very much by design. Otherwise you could brute force the “admin” password by logging in as your own user every 4th attempt.

A reverse proxy is a server in between the site and the Internet (perhaps handling caching or load-balancing). This makes getting the correct client IP to block slightly more complicated.

The option default to NOT being behind a proxy — which should be by far the common case.

You probably are not or you would know. We show a pretty good guess on the option page. Set the option using this unless you are sure you know better.

First please consider if you really need this. Generally speaking it is not a good idea to have exceptions to your security policies.

That said, there is now a filter which allows you to do it: “limit_login_whitelist_ip”.

Example:

function my_ip_whitelist($allow, $ip) {

return ($ip == ‘my-ip’) ? true : $allow;

}

add_filter(‘limit_login_whitelist_ip’, ‘my_ip_whitelist’, 10, 2);

Either wait, or:

If you know how to edit / add to PHP files you can use the IP whitelist functionality described above. You should then use the “Restore Lockouts” button on the plugin settings page and remove the whitelist function again.

If you have ftp / ssh access to the site rename the file “wp-content/plugins/limit-login-attempts/limit-login-attempts.php” to deactivate the plugin.