Limit login attempts, built in.
The same model you know — allowed retries, lockout minutes, lockouts before a long lockout, hours until retries reset — plus safelists and denylists with wildcards and CIDR ranges. Your settings come across on migration.
Replaced by the bundled Security plugin · Included free with Presscomet
Switching from Limit Login Attempts Reloaded: the short version.
You get
- Retries, lockout length, long lockouts and reset window
- IP safelist and denylist with wildcards and CIDR
- Username denylist and generic login errors
- Counts passkey and two-factor failures too
Not included
- No cloud-based blocklist or shared attack data
- No country blocking
Why a login limit is still worth having
Brute-force bots try common passwords against any login form they find. Limiting attempts per IP slows them to a crawl, and long lockouts stop repeat offenders. It’s simple and effective — which is why it’s built in here.
With two-factor login or passkeys turned on as well, a guessed password alone isn’t enough to get in.
Limit Login Attempts Reloaded vs Presscomet
Feature by feature, including what isn’t there. Rows describe what the bundled plugin’s code does today.
| Feature | Limit Login Attempts Reloaded | Presscomet |
|---|---|---|
| Allowed retries & lockout time | Included: Yes | Included: Yes |
| Long lockouts after repeated lockouts | Included: Yes | Included: Yes |
| IP safelist / denylist | Included: Yes | Included: Yes, wildcards and CIDR |
| Username denylist | Included: Yes | Included: Yes |
| Lockout email | Included: Yes | Included: Yes |
| Cloud blocklist, country rules | Partly: Premium | Not included: Not included |
| Two-factor login | Not included: No | Included: Built into the core |
- Included
- Partly, or on a paid plan
- Not included
- Not needed, with the reason
Limit Login Attempts Reloaded features as publicly documented; plans change.
What moves over automatically.
The importer reads both the classic limit_login_* option names and the newer llar_* names.
Imported
- Allowed retries, lockout duration, allowed lockouts, long duration, valid duration
limit_login_allowed_retrieslimit_login_lockout_durationlimit_login_allowed_lockoutslimit_login_long_durationlimit_login_valid_duration - Safelist, denylist and username denylist
limit_login_whitelistlimit_login_blacklistlimit_login_blacklist_usernames - Lockout email notification
limit_login_lockout_notify - Loginizer: retries, lockout time, lockouts, extended lockout
loginizer_options
Not imported
- Current lockouts and lockout history
- Cloud app settings
- Security: imported login-limiting settings.
How switching works.
- 01
Check your site
Run the free site check to see which of your plugins Presscomet replaces and what needs attention.
- 02
Run the migration
Connect your WordPress site. Content, users, media and plugin settings are imported into a new Presscomet site; your live site is only read.
- 03
Review and switch
Open Settings → Security → Login Security to check the imported settings, then point your domain at the new site when you’re happy.
Where to find it: Settings → Security → Login Security.
Limit Login Attempts Reloaded alternative: questions
Are my safelisted IPs kept?
Yes. The safelist, denylist and username denylist are imported.
Can I use IP ranges?
Yes. Use wildcards like 203.0.113.* or CIDR ranges like 203.0.113.0/24.
Can I keep running Limit Login Attempts Reloaded instead?
No. Presscomet doesn’t run PHP, so WordPress plugins can’t be installed. The bundled Security plugin does the job instead, and the migration imports the settings listed above.
Does Presscomet support WooCommerce?
Not today. Presscomet is for content sites — blogs, magazines, business and documentation sites. If your site sells through WooCommerce, it isn’t a fit yet.
Related plugins and next steps
Related
- BundledSecurityLogin limiting with lockouts, allow/deny lists, an activity log, author-scan blocking and security headers. 2FA and passkeys are built in.
- AlternativeWordfence alternativeNo WAF or scanner — and why that matters less without PHP. Login limits, 2FA, passkeys and headers built in.
- BundledAntispamLocal comment and form spam checks — no API key, nothing sent to third parties — with statistics and scheduled clean-up.
Move your WordPress site in one go — content, users, media and plugin settings. Free and open source; your live site is only read.
Managed hosting with backupsAll 19 bundled plugins
Limit Login Attempts Reloaded, Loginizer are trademarks of their respective owners. Presscomet is not affiliated with or endorsed by them. Names are used only to describe compatibility and migration.