How the lockout works

Failures from one address are counted inside a window — fifteen minutes by default. When the count reaches the limit, that address is locked out, and every attempt from it is refused without the password being looked at. An IPv4 address that a server writes the IPv6 way (::ffff:203.0.113.7) is counted as the plain address.

The lockout gets longer each time the same address comes back:

Three times longer each time, and never more than a day. A machine that keeps coming back gets a wait that stops being worth its while; somebody who mistyped their password on three separate occasions this year is not locked out until tomorrow.

A correct password does not clear the address's count. Wrong passwords from that address go on counting for the rest of the window, and its lockouts go on getting longer, after somebody signs in from it. On a shop where anybody can register, the machine guessing at other people's accounts has an account of its own to sign in to between guesses, so a sign-in says nothing about the other attempts from the same address. With the defaults, three wrong, one right and two more wrong inside fifteen minutes is five from that address, and it is locked out. What a correct password does clear is the count against that one username: see below.

Letting an address back in clears its count. Let in on a row, Let everybody back in, and wp login-security unlock start the count again, so the person gets the full number of tries and not one. Let in and unlock <address> also put that address's next lockout back to the first length. They work the same on a site whose host keeps an object cache such as Redis or Memcached, where the lockouts are held in that cache and not in the database.

The slow, spread-out kind#

Counting by address does nothing against one password list worked through from a thousand different machines — none of them ever reaches five tries. So failures are counted against the username as well, across every address they came from. Twenty by default, because a real person mistyping twenty times is rare and a list being worked through gets there in seconds.

Both counts are in the same window. A correct password starts the count against that username again, and leaves the address's count as it was. The same two counts stand behind the six digits of the second step, so a stolen password cannot be used to guess those from a pool of addresses either.

Both counts work whether or not Record every attempt is on under What is kept. With it off, nothing is written to the log: each count is kept only as a short-lived number under a scrambled key, and its window starts at the first failure instead of moving along with each new one.