Rate-limit wp-login without locking yourself out in a hotel

A sensible wp-login rate limit lets a few failed attempts through, then delays or blocks further tries for a short window. That slows password guessing without treating one typo on hotel Wi-Fi or LTE as a permanent ban. Pair it with 2FA, keep XML-RPC limited or off if you do not need it, and know how you will unlock yourself before you travel.

What a useful limit actually covers

Hiding or renaming wp-login.php is only obscurity. It can sit on top of real controls, but it is not the control. Rate-limit the login action itself after a small number of failures. XML-RPC is another login path, so close it when unused or apply the same kind of limit there. Otherwise brute force simply moves one file over and still burns CPU.

Do not blanket-ban all of /wp-admin or every POST that touches admin-ajax.php. Cart updates, editor autosave, and many plugins post there. A rule that treats the whole admin tree like login will break the site for real visitors. Limit login, not every admin endpoint.

Settings that survive travel

Five failed attempts, then about fifteen minutes of lockout, is usually enough. Guessing becomes expensive, and one mistyped password on shared hotel Wi-Fi does not become a support ticket. If you have a static office IP, you may allow that address. Do not open the door to the whole internet with a wide allow list.

When you move between networks, 2FA plus a short delay beats an IP allow list you will leave behind. Before you fly, confirm how you unban yourself: WP-CLI, a second admin path the limiter does not cover, or File Manager in cPanel to disable the limiter plugin if needed.

One stack, not three fighting tools

Imunify and LiteSpeed on our shared platform may already slow repeated POSTs. Stacking several aggressive limiters makes a health check or mobile app look like an attack. One clear login limit, 2FA, and XML-RPC off when you do not need it is enough for most WordPress sites.

If a CDN WAF also rate-limits login, put the rule in one place or keep thresholds aligned. Two different bans can lock your phone and still miss a botnet. After you enable the limit, watch 403 logs for a day so you can see whether checkout or an app is hitting the same rule. Hiding the PHP version header can wait; this login door should not.

Quick checklist before you leave

1. Set about five failures, then a short delay—not a permanent ban after two tries.
2. Protect or disable XML-RPC if you do not rely on it.
3. Turn on 2FA for admin users so a stolen password is not enough.
4. Know your unlock path: WP-CLI, cPanel File Manager, or an alternate admin route.
5. Test from a non-office network so you learn the lockout behavior before a trip.

On WordPress accounts here you can manage many of these pieces from cPanel and WP Toolkit, with AutoSSL already covering HTTPS so login stays on a secure connection. Same price at renewal, and hosting and VPS still carry the 30-day money-back window if you are still settling in.