Brute-force attacks — bots guessing passwords — are among the most common attacks against WordPress sites. PowerSEC limits them before they can guess your password.
How brute-force attacks work
A bot tries many username + password combinations against /wp-login.php and /xmlrpc.php. Common patterns:
- Dictionary attacks — common passwords like "password123"
- Credential stuffing — passwords leaked from other sites
- Targeted guesses — names, pets, birthdays
How PowerSEC limits them
Failed-login lockout (on by default)
When one address fails to log in 5 times within 60 minutes, that address is blocked for 60 minutes. The lockout is per address (IP); a successful login clears that address's failed attempts.
You can change the number of attempts in WordPress under PowerSEC → Login Security, and the lockout duration (which is also the counting window) from the site's Settings page in PowerSEC Central.
XML-RPC (disabled by default)
PowerSEC disables XML-RPC logins by default and blocks the XML-RPC methods attackers use to try many passwords in one request.
Optional extra checks (off until you turn them on)
- Login CAPTCHA — adds a short "Security Check" code to the login form for every login attempt.
- Email login code — a second sign-in step: after the correct password, WordPress asks for a code emailed to the account's address.
- Magic links — passwordless login through an emailed link.
All three are available on every plan, under PowerSEC → Login Security.
Notifications
A lockout is recorded in the Audit Log as a high-severity event, so it is emailed to you with the default notification settings. You can mute specific events under PowerSEC → Settings → Notifications & SIEM.
If you lock yourself out
- Wait for the lockout to end (60 minutes by default)
- Or log in from another network (for example your phone's data connection), then open PowerSEC → IP Blocking → Currently blocked IPs and click Unblock next to your address
Administrators who are already logged in are not blocked by the firewall. Under PowerSEC → Advanced → Recovery mode you can generate a recovery token in advance, or allowlist your current session for an hour.
Behind a CDN or proxy
If lockouts seem to affect every visitor at once, PowerSEC may be seeing your proxy's address instead of the visitor's.
- If the site is behind Cloudflare, nothing needs setting up: PowerSEC recognizes Cloudflare's network and reads the visitor's real address from it
- For any other proxy, CDN or load balancer, add its addresses under Trusted proxies (PowerSEC → Advanced)