Security: Login Throttle

Locks out login attempts from an IP address after too many failures, to slow

down brute-force credential guessing.

Capabilities and extension points

Locks out login attempts from an IP address after too many failures, to

slow down brute-force credential guessing.

Thresholds can be tuned by a child theme, e.g.:

add_filter( 'cherry/blossom/login_throttle/max_attempts', fn() => 10 ); add_filter( 'cherry/blossom/login_throttle/lockout_seconds', fn() => 30 * MINUTE_IN_SECONDS );

Registers hooks for login throttling.

Rejects authentication while the requesting IP is locked out.

• param \WP_User|\WP_Error|null $user Authentication result so far.
• return \WP_User|\WP_Error|null Unmodified result, or a lockout error.

Increments the failed-attempt counter for the requesting IP.

Clears the failed-attempt counter after a successful login.

Returns the current failed-attempt count for the requesting IP.

• return int

Builds the transient key for the requesting IP.

• return string

Returns the requesting IP address.

• return string

Filters the client address used for login attempt counters.

Proxy integrations must verify the trusted proxy before using forwarded headers. Invalid replacements retain the original remote address.

• param string $remote_address Server-provided remote address.
• param Login_Throttle $throttle Login throttle instance.

Returns the maximum allowed failed attempts before lockout.

Tunes the attempt limit through cherry/blossom/login_throttle/max_attempts. The filtered value is cast to an integer; use a positive attempt count.

• return int

Returns the lockout duration in seconds.

Tunes the duration through cherry/blossom/login_throttle/lockout_seconds. The filtered value is cast to an integer; use a positive number of seconds.

• return int

Source reference

This editable reference page is based on the PHP documentation in security/class-login-throttle.php.