WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to stop it :

"A host, can check the host at http://ip-adress.com/ip_tracer/ has been locked out of the WordPress site at http://my_site.com until Friday, February 22nd, 2013 at 9:41:54 am UTC due to too many login attempts. You may login to the site to manually release the lock if necessary."

share|improve this question
up vote 1 down vote accepted

It looks like you have the plugin Better WP Security


installed with the Enable login limits feature activated here /wp-admin/admin.php?page=better-wp-security-loginlimits. You can configure the plugin to stop sending you these messages. But you should have the feature activated, since most likely some bot is trying to login. Or even consider to blacklist this IP in the plugin via the Ban page in /wp-admin/admin.php?page=better-wp-security-banusers (if you are sure this is not an actual user in your Wordpress trying to login)

ps: I get these messages a lot and on some installs I use the htpasswd to stop the bots from accessing the wp-login page ;-)

share|improve this answer

You could also use something like SI CAPTCHA which adds a captcha to your login page and this will prevent bots from using brute force attacks on your Wordpress.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.