--- title: "Block brute-force login attempts" description: The Security Login module locks the Ultimate Membership Pro login form for an IP address after too many failed attempts, and can block chosen IP addresses for good. url: "https://ultimatemembershippro.com/docs/security-login/" updated: "2026-10-18" category: "Registration & Login" --- # Block brute-force login attempts 4 minIntermediateUltimate Membership Pro 14.2+ · Module Security Login is an Ultimate Membership Pro module that counts failed logins per IP address and locks the login form for that address for a while, then for longer if the attempts go on. This brute force login protection stops bots that try thousands of passwords on login forms. This guide sets up the module for the Coaching Club site: 5 tries, a 30-minute lock, then a 24-hour lock after 3 lockouts. Before you start - Your license is active. This module needs an active license; see [Find and activate your license key](https://ultimatemembershippro.com/docs/where-to-find-your-license-key/). - Members log in with the Ultimate Membership Pro login form. See [Set up the login form](https://ultimatemembershippro.com/docs/set-up-the-login-form/). ## How the lock works 1. Each wrong password from an IP address counts as a failed attempt. The member sees the usual “Invalid email address or password entered”. 2. When the failed attempts reach **Allowed Retries**, each one within the **Locked Time** of the one before, the IP address is locked out for the Locked Time. Every login from it is refused, even with the right password, and the form shows the **Locked Message**. 3. After the Locked Time, the address gets a new set of tries. 4. When an address has been locked out **Maximum number of Lockouts** times, the form is hidden from it for the **Extended Locked Time** and replaced by the **Extended Locked Message**. The lock applies to the Ultimate Membership Pro login form wherever it appears: the Login Page, [login popups](https://ultimatemembershippro.com/docs/login-and-registration-popups/) and the login form inside Lockers. ## Switch on the module 1. Go to Ultimate Membership Pro*›*Modules and open **Security Login**, in the **Security & Login** group. 2. Switch on **Activate/Hold Security Login**. ## Set the limits [![Security Login settings switched on with Allowed Retries 5, Locked Time 30 minutes, Maximum number of Lockouts 3, Extended Locked Time 24 hours, Notify Admin after 2 and two IP addresses in the Black IP list](https://ultimatemembershippro.com/wp-content/uploads/2026/10/ump-security-login-01-settings.png)](https://ultimatemembershippro.com/wp-content/uploads/2026/10/ump-security-login-01-settings.png) Limits for the example. The numbers match the list below. 1Allowed Retries Failed attempts before the IP address is locked out. Default: **3** 2Locked Time Minutes the login form stays locked for that address. Default: **15** 3Maximum number of Lockouts Lockouts before the longer, extended lock starts. Default: **3** 4Extended Locked Time Hours the form is hidden from that address after the last lockout. Default: **24** 5Notify Admin after Emails you when an IP address is locked out for this number of times. The email goes to the Admin Notifications Email Address(es) set in Settings*›*Notifications Settings, or to the WordPress admin email. Default: **2** 6Black IP list IP addresses that never see the login form, separated by commas, without spaces. They see “You are not allowed to see this Page.” instead. Use full addresses; ranges aren't supported. Default: **Empty** **Reset Retries after** can stay as it is: the counters start again on their own after the Locked Time and the Extended Locked Time. ## Match the messages to your limits The default texts mention 15 minutes and 24 hours. They don't change when you change the numbers, so edit them to match: [![Security Login messages: Fail Login Attempt Message, Locked Message changed to mention 30 minutes, and Extended Locked Message](https://ultimatemembershippro.com/wp-content/uploads/2026/10/ump-security-login-02-messages.png)](https://ultimatemembershippro.com/wp-content/uploads/2026/10/ump-security-login-02-messages.png) The Locked Message rewritten for a 30-minute lock. 1Locked Message Shown under the form during a lockout. Default: **Login Form is locked for 15 minutes.** 2Extended Locked Message Shown instead of the form during the extended lock. Default: **You have made too many failed login attempts. Login Form will be locked for 24 hours.** Leave **Fail Login Attempt Message** as it is. After a wrong password, members see the login form's General Error Message, which you edit in the Login Form showcase. Click Save Changes. Good to know - Attempts are counted per IP address, not per account. People who share a network, such as an office, share the count. - There's no list of locked addresses in the admin. A lockout ends by itself after the Locked Time or Extended Locked Time; an address in the Black IP list stays blocked until you remove it. - Before you add an address to the Black IP list, make sure it isn't your own. - The module [protects the plugin's login form](https://ultimatemembershippro.com/features/login-security/). For the WordPress login page (wp-login.php), [use a security plugin](https://developer.wordpress.org/advanced-administration/security/brute-force/), or hide that page with the paid add-on [Hidden WP Login](https://ultimatemembershippro.com/addon/hidden-wp-login/). ## Example: Coaching Club login security **Security Login**Five tries, then 30 minutes off. After three lockouts the form is gone for a day, and you get an email at the second lockout. **Allowed Retries** : 5 **Locked Time** : 30 Minutes **Maximum number of Lockouts** : 3 **Extended Locked Time** : 24 Hours **Notify Admin after** : 2 **Black IP list** : 203.0.113.25,198.51.100.7 **Locked Message** : Too many failed attempts. The login form is locked for 30 minutes. ## Troubleshooting Why does the login form say “Login Form is locked for 15 minutes.”? Ultimate Membership Pro shows this message when the IP address reached Allowed Retries in the Security Login module. Wait for the Locked Time, then log in with the right password, or reset it from the Lost your password link. Why does the login form say “You have made too many failed login attempts. Login Form will be locked for 24 hours.”? Ultimate Membership Pro shows this message when the IP address reached the Maximum number of Lockouts. The form comes back after the Extended Locked Time. Why do I see “You are not allowed to see this Page.” instead of the login form? Ultimate Membership Pro shows this message instead of the login form when the visitor's IP address is in the Black IP list. Remove the address there and save. How do I get back in after locking myself out? If you locked yourself out, log in from another network (for example your phone's mobile data) or wait for the lock to end. Administrators can also log in at wp-login.php. Why doesn't the Security Login admin alert arrive? The Security Login admin alert goes to the Admin Notifications Email Address(es) in Settings › Notifications Settings. Check that address and that your site can send email. See [Set up email notifications](https://ultimatemembershippro.com/docs/how-to-send-notifications/). ## What's next [**Prevent account sharing**One active session per member.](https://ultimatemembershippro.com/docs/cheat-off/)[**Add Google reCAPTCHA**Stop bots before they try.](https://ultimatemembershippro.com/docs/how-to-enable-recaptha/)[**Style the WordPress login page**The look of wp-login.php.](https://ultimatemembershippro.com/docs/customize-wp-login-style/)[**Login and registration problems**Fix common login issues.](https://ultimatemembershippro.com/docs/register-form-not-work/)