by michael.damoiseau 4.4 (5 reviews)

Login Delay Shield

Name: Login Delay Shield
Rating: 4.4 (5 reviews)
Author: michael.damoiseau

Login Delay Shield slows down brute-force attacks by adding a configurable delay to failed login attempts while keeping successful logins instant.

Login Delay Shield ranks #19,090 among WordPress.org plugins with 60+ active installations, is #439 of 1,589 in the Authentication category, a 4.4/5 rating from 5 reviews, and was last updated Jul 15, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Tested up to WP 7.0.5 (Current: 7.1.1)

v2.6.0 Current Version v2.6.0

Updated 2 months ago Last Update on 15 Jul, 2026

Refreshed 6 hours ago Last Refreshed on

#439 of 1,589 in Authentication Top 50% by installs Downloads -58.8% this week

View on WordPress.org

Rank

#19,090

+20 this week

Active Installs

60+

-7.7%

KW Avg Position

45.3

— No change

Downloads

5.6K

+1 today

Support Resolved

— No change

Rating

88%

Review 4.4 out of 5

4.4 (5 reviews)

Next Milestone 70

Total Progress 80%

60+ 70+

413

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 2 more installs to reach 70+

Rank Changes

Current #19,090

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.4

5 reviews

Overall 88%

4 (80%)

0 (0%)

1 (20%)

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.6.0
Last Updated: Jul 15, 2026
Requires WP: 3.5.1+
Tested Up To: 7.0.5
PHP Version: 7.4 or higher
Author: michael.damoiseau

Support & Rating

Rating: ★ ★ ★ ★ ☆ 4.4
Reviews: 5
Support Threads: 0
Resolved: 0%

Keywords

Brute Force lockout login security xmlrpc

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,760

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,010

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

1M+ installs

#61

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Login Delay Shield

When a bot attempts a brute-force attack, it tries thousands of passwords as fast as possible. By adding a delay (even just 1 second) after each failed attempt, the attack becomes impractical. A one-second delay is barely noticeable to legitimate users but makes a huge difference when multiplied across thousands of attempts.

Go to Settings > Login Delay Shield

Protection profiles are guided presets in the Security Setup Wizard. Applying a profile updates the main delay, progressive delay, lockout, email alert, and authentication endpoint settings, while still leaving every individual control editable.

Progressive delay increases the wait time with each consecutive failed attempt from the same IP address. For example, the first failure might delay 1 second, the second failure 2 seconds, and so on. This makes repeated attacks increasingly slow.

After a configurable number of failed attempts (default: 10), login attempts are temporarily blocked. You can choose whether attempts are counted by IP only or by IP + username (recommended for shared office/mobile IPs). Lockout duration is configurable (default: 60 minutes).

When lockout is enabled, failed logins show how many attempts remain before temporary lockout. If lockout is triggered, the error message includes a countdown (for example, "try again in 2 minutes") so users know when to retry.

Enable the IP whitelist feature and add your IP address (or a range using CIDR notation like 192.168.1.0/24). Whitelisted IPs bypass all delays and lockouts, ensuring you never lock yourself out.

You can always get back in. Lockouts are temporary by design (24 hours maximum — there are no permanent bans), so waiting always works. To recover immediately: If another administrator can log in, the Active Lockouts manager on the settings page shows every current lockout with a one-click Unlock, and an "Unlock Current IP" action. If you set up the optional Emergency Recovery URL in advance, open that saved link and confirm — it clears your own IP lockout with no admin, shell, or file access needed. See the next question. With shell access, use WP-CLI: wp wp-login-delay unlock-ip <ip> or wp wp-login-delay flush-lockouts. With only FTP access, add define( 'WLDELAY_SAFE_MODE', true ); to wp-config.php — this safe mode disables all delays and lockouts until you remove the line (a warning shows in the admin while it is active). To avoid lockouts entirely, whitelist your own IP (CIDR ranges supported) — whitelisted IPs bypass all delays and lockouts.

It is an optional, off-by-default secret link you generate in advance from the settings page (Settings > Login Delay Shield). Save it somewhere safe and off your site — it is shown once on screen, emailed to your admin address, and offered as a .txt download. If you are ever locked out with no admin login, no shell, and no file access, open the link and confirm: it clears the login lockout for your current IP only. It never logs you in (you still sign in normally afterwards) and never disables protection. Because anyone who holds the link can clear their own lockout, treat it like a password. The plugin stores only a hash in its long-term settings, but the freshly generated URL may exist briefly in transient storage so it can be shown and downloaded once. Opening the link asks for a confirmation click before doing anything, attempts are rate-limited and recorded in the audit log, and the plugin reminds you to regenerate it after 90 days (regenerating invalidates the previous link immediately).

No. Login Delay Shield is completely free: no ads, no upsells, no premium tier, no account, and no API keys. Every admin notice is dismissible.