#51 by installs
Security Optimizer – The All-In-One Protection Plugin
Secure your WordPress site from brute-force attacks, threats, malware, and bots. Free to use and easy to set up.
- Installs
- 1+ million
- Rating
- 4.5 (157)
- Updated
- 17 days ago
Login Lockdown & Protection
Protect, lockdown & secure login form by limiting login attempts from the same IP & banning IPs.
- Active installs
- 100,000+
- #373 of 1,000
- Downloads, all time
- 2.1M
- 2,147,625
- Downloads, 30 days
- 77.8K
- 7.1K in the last 7
- Rating
- 4.3 / 5
- 61 reviews
- Last updated
- 25 days ago
- Oct 6, 2026
- Version
- 2.19
- 30 releases
Upkeep and compatibility
| Last updated | October 6, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 4.0 or newer |
| Needs PHP | 5.2 or newer |
| First published | June 16, 2008 |
| Support, last two months | 5 of 5 threads resolved (100%) |
Reviews
4.3 / 5 from 61 reviews
| 5 stars | 48 |
|---|---|
| 4 stars | 0 |
| 3 stars | 4 |
| 2 stars | 0 |
| 1 star | 9 |
Downloads, last 30 days
What the author says it does
Login Lockdown records the IP address and timestamp of failed login attempts. If more than a selected number of attempts are detected within a set period of time from the same IP, then the login is disabled for all requests from that IP address (or the IP is completely blocked from accessing the site). This secures the site and helps prevent brute force password attacks & discovery.
The plugin defaults to a 1 hour lock out of an IP block after 3 failed login attempts within 5 minutes. This can be modified in options. Administrators can release locked out IPs manually from the panel. A detailed log is available for all failed login attempts and all IP locks to control lockdown.
Configure the plugin from Settings – Login Lockdown.
Country blocking (PRO feature)
Block unwanted countries from accessing the site, or block them from being able to log in. Display a custom message to blocked visitors so they know why they can’t access the site.
Captcha
The simplest way to get rid of bots and brute-force password attacks. Choose from 5 different versions – built-in one, two from Google (PRO feature), Cloudflare Turnstile, and hCaptcha (PRO feature). Built-in captcha is GDPR compatible.
2FA – Two Factor Authentication (PRO feature)
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
How to disable this plugin?
Just use standard Plugin overview page in WordPress admin section and deactivate it; or rename the plugin folder /wp-content/plugins/login-lockdown/ using FTP access.
Will it slow my site down?
No, it won’t. The majority of the code is only run when logging in.
How can I report security bugs?
You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.
Latest changelog entry
- 2026/10/06
- bug fixes
Screenshots
Protect the login form by banning IPs with multiple failed login attempts 
Activity shows all failed login attempts and currently banned IPs 
Country blocking (PRO feature) allows you to block selected countries from accessing the site
Tagged
Plugins that share its tags
#401 by installs
Hide My WP Ghost – Security & Firewall
Hide My WP Ghost is a WordPress security plugin that hides WP paths and protects your site with Path Security, Firewall, Brute Force Protection, 2FA
- Installs
- 100,000+
- Rating
- 4.5 (373)
- Updated
- 1 day ago
#882 by installs
Security Plugin, Firewall & Malware Scanner with Auto Removal
Protect WordPress from malware, hackers, brute-force attacks & suspicious traffic. Includes firewall, login security, 2FA & vulnerability checks.
- Installs
- 40,000+
- Rating
- 4.8 (397)
- Updated
- 4 days ago
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
- Installs
- 5+ million
- Rating
- 4.7 (5K)
- Updated
- 31 days ago
#27 by installs
WPS Hide Login
Change wp-login.php to anything you want.
- Installs
- 2+ million
- Rating
- 4.8 (2.1K)
- Updated
- 3 months ago
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
- Installs
- 1+ million
- Rating
- 4.8 (1.5K)
- Updated
- 38 days ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.