by michael.damoiseau 4.4 (5 reviews)

Login Delay Shield

Name: Login Delay Shield
Rating: 4.4 (5 reviews)
Author: michael.damoiseau

Login Delay Shield slows down brute-force attacks by adding a configurable delay to failed login attempts while keeping successful logins instant.

Login Delay Shield ranks #18,541 among WordPress.org plugins with 70+ active installations, is #427 of 1,659 in the Authentication category, a 4.4/5 rating from 5 reviews, and was last updated Sep 29, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v2.7.0 Current Version v2.7.0

Updated 1 month ago Last Update on 29 Sep, 2026

Refreshed 1 week ago Last Refreshed on

#427 of 1,659 in Authentication Top 25% by installs

View on WordPress.org

Rank

#18,541

— No change

Active Installs

70+

-2.8%

KW Avg Position

0.7 worse

Downloads

4.4K

+5 today

Support Resolved

— No change

Rating

88%

Review 4.4 out of 5

4.4 (5 reviews)

Next Milestone 80

Total Progress 60%

70+ 80+

1,264

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 4 more installs to reach 80+

Rank Changes

Current #18,541

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.4

5 reviews

Overall 88%

4 (80%)

0 (0%)

1 (20%)

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.7.0
Last Updated: Sep 29, 2026
Requires WP: 3.5.1+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: michael.damoiseau

Support & Rating

Rating: ★ ★ ★ ★ ☆ 4.4
Reviews: 5
Support Threads: 0
Resolved: 0%

Keywords

Brute Force lockout login security xmlrpc

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Login Delay Shield

When a bot attempts a brute-force attack, it tries thousands of passwords as fast as possible. By adding a delay (even just 1 second) after each failed attempt, the attack becomes impractical. A one-second delay is barely noticeable to legitimate users but makes a huge difference when multiplied across thousands of attempts.

Go to Settings > Login Delay Shield

Protection profiles are guided presets in the Security Setup Wizard. Applying a profile updates the main delay, progressive delay, lockout, email alert, and authentication endpoint settings, while still leaving every individual control editable.

Progressive delay increases the wait time with each consecutive failed attempt from the same IP address. For example, the first failure might delay 1 second, the second failure 2 seconds, and so on. This makes repeated attacks increasingly slow.

After a configurable number of failed attempts (default: 10), login attempts are temporarily blocked. You can choose whether attempts are counted by IP only or by IP + username (recommended for shared office/mobile IPs). Lockout duration is configurable (default: 60 minutes).

When lockout is enabled, failed logins show how many attempts remain before temporary lockout. If lockout is triggered, the error message includes a countdown (for example, "try again in 2 minutes") so users know when to retry.

Enable the IP whitelist feature and add your IP address (or a range using CIDR notation like 192.168.1.0/24). Whitelisted IPs bypass all delays and lockouts, ensuring you never lock yourself out.

You can always get back in. Lockouts are temporary by design (24 hours maximum — there are no permanent bans), so waiting always works. To recover immediately: If another administrator can log in, the Active Lockouts manager on the settings page shows every current lockout with a one-click Unlock, and an "Unlock Current IP" action. If you set up the optional Emergency Recovery URL in advance, open that saved link and confirm — it clears your own IP lockout with no admin, shell, or file access needed. See the next question. With shell access, use WP-CLI: wp wp-login-delay unlock-ip <ip> or wp wp-login-delay flush-lockouts. With only FTP access, add define( 'WLDELAY_SAFE_MODE', true ); to wp-config.php — this safe mode disables all delays and lockouts until you remove the line (a warning shows in the admin while it is active). To avoid lockouts entirely, whitelist your own IP (CIDR ranges supported) — whitelisted IPs bypass all delays and lockouts.

It is an optional, off-by-default secret link you generate in advance from the settings page (Settings > Login Delay Shield). Save it somewhere safe and off your site — it is shown once on screen, emailed to your admin address, and offered as a .txt download. If you are ever locked out with no admin login, no shell, and no file access, open the link and confirm: it clears the login lockout for your current IP only. It never logs you in (you still sign in normally afterwards) and never disables protection. Because anyone who holds the link can clear their own lockout, treat it like a password. The plugin stores only a hash in its long-term settings, but the freshly generated URL may exist briefly in transient storage so it can be shown and downloaded once. Opening the link asks for a confirmation click before doing anything, attempts are rate-limited and recorded in the audit log, and the plugin reminds you to regenerate it after 90 days (regenerating invalidates the previous link immediately).

No. Login Delay Shield is completely free: no ads, no upsells, no premium tier, no account, and no API keys. Every admin notice is dismissible.