Right now, bots are guessing passwords against your login form and through XML-RPC — thousands of tries, around the clock. MalCare ships five layers of login protection, on automatically from the moment you connect: a 400,000-site bot network, login limits, captcha, IP whitelisting, and built-in 2FA. Attackers run out of road. You and your team never notice any of it.
Trusted by 400,000+ websites across 120 countries
Brute force is bots trying username and password combinations until one works. The evidence is in your own logs — floods of failed logins. It isn't personal; it's every site, all the time. And every guess burns CPU and bandwidth, so the siege slows your real visitors even when it never gets in.
Read: XML-RPC accepts logins remotely — attackers send relentless request floods against it with varying passwords. MalCare's login protection covers the form and XML-RPC, automatically.
The door everyone guards — floods of password guesses.
GUARDEDThe door attackers love — remote login floods most plugins ignore.
ALSO GUARDEDNo single lock survives everything — a limiter can't stop a stolen password, and 2FA alone still lets bots burn your server. The combination does. And it's on by default.
The 400,000-site network convicts crackers before their first guess here. Ends: the botnet. How bots are identified →
Repeated failures get locked out — on the form and XML-RPC alike. Ends: the patient guesser.
A challenge humans pass in seconds — and scripts don't. Ends: the automated retry.
Known users' IPs are never locked out at all. Ends: the false positive.
A correct stolen password still isn't enough. Ends: the leaked password. How 2FA works →
Each layer ends what the previous one can't. Attackers run out of road before the door.
The real fear with login limits is locking yourself out — and with crude time-based plugins, it's justified. MalCare's answer is structural: locked-out humans unblock themselves immediately with reCAPTCHA. No waiting out a timer, no emailing your host. And normal logins look completely normal.
Read: the lockout is the same for everyone — the recovery isn't. A human proves it in one captcha and walks back in; an automated script stays outside indefinitely.
Mistyped ×5 → captcha → back in. Seconds, self-serve.
RECOVEREDGuessing → captcha it can't pass → still locked.
FOREVERLock everyone out for a fixed period — including you, on a bad-memory day.
20 MIN · EVERYONEHumans recover immediately via reCAPTCHA; scripts never do. Strictness without the collateral.
SECONDS · HUMANSWhitelist their IPs — whitelisted users aren't subject to lockouts at all.
PRE-CLEAREDNo thresholds to pick, no lockout durations to weigh, no settings page to revisit. Login protection operates automatically once your site is connected to MalCare. Want proof? Try to log in wrong, quickly, and watch yourself get locked out — then pass the captcha and walk back in.
Pick retry counts, tune lockout durations, maintain one more plugin forever.
YOUR HOMEWORKEdit a critical theme file, risk a fatal error, lose it on the next theme update — and block themes don't even have the file.
YOUR RISKConnected = protected. All five layers, already running.
ALREADY DONELogin floods strain server resources — real visitors feel a slow, unresponsive site. Ending the siege isn't just security; it's performance you can measure.
Every blocked guess is CPU and bandwidth your real visitors get back.
LIGHTEREvery attempt — blocked, failed, or successful — lands in the activity log. The siege becomes visible, and so does anything unusual.
ON RECORDLogin protection guards the most-attacked door; the rest of the suite covers everything around it.
Manages the non-human crowd — most crackers never arrive.
THE BOUNCERGuards the door — limits, captcha, whitelist, 2FA, combined.
THE GAUNTLETBlocks attack payloads — exploits inside individual requests.
THE PERIMETERFinds whatever slips through, wherever it hides.
THE SEARCHLIGHTRecords every hand that touches the site — including every login.
THE RECORDOne dashboard — every layer already on.
Real customers — quotes from our reviews and case studies.
Best login protection ever! We handle hundreds of sites, and I'd heard bad stories about brute force attacks & password hacking… but thankfully we never had to worry about this because of MalCare. I'm sure this saved us from many sleepless nights!
I was on the beach with my family when MalCare notified me of a plugin vulnerability across 50 of my sites. With one click on my smartphone, all sites were fixed within minutes.
Paul LaceyWordPress ExpertI had been running iThemes, WordFence & Sucuri, but they kept getting hacked. Then I installed MalCare, which quickly found the malware and cleaned up the entire site.
Adam SilverConciergeWP · FounderRepeated rapid failures trigger it — industry guidance puts the right threshold at 3–5 attempts, and MalCare handles this automatically. There's nothing for you to configure or tune.
Pass the reCAPTCHA and you're back in immediately. No waiting out a timer, no support ticket to your host — the recovery is self-serve and takes seconds.
Yes. Whitelist their IPs — whitelisted users aren't subject to lockouts, even after failed attempts. Useful for offices, agencies, and anyone who logs in daily.
Yes. XML-RPC accepts logins remotely and attackers flood it with password attempts exactly like the login form — so MalCare guards both doors, not just the one with a visible login box.
No. Normal logins look completely normal. The captcha appears as the recovery path after a lockout — a quick check that you're human, not a routine hoop.
They stop different things. Login limits stop guessing; 2FA stops a correct stolen password. Both are included in the plugin — use both.
They're layers, not duplicates. Bot protection convicts bad actors across the 400,000-site network before they guess here; login limits catch whoever still gets through. Together they end the siege from both ends.
The opposite. Login floods burn CPU and bandwidth; blocking them removes that load, and your real visitors get a faster site.
Five layers of login protection, on automatically. Bots run out of road; your team never notices.
No configuration · no lengthy lockouts · 2FA included
