Is it alright conceptually to update transient value frequently.

I am building up a login form & every time user enters invalid credentials, store the incorrect attempts.

So I am using user IP address & creating a key like "login_data_IPXXX" with an array value. There is a lot more information other than incorrect attempts which I would like to store.

Before now I was storing it in a session key & found that sessions shouldn't be used in WP.

Then I thought about using transients, as this value gets updated frequently & is a temporary data, I am confused whether I should use transient or not. If not, what should be used instead?

Cookies is also not an appropriate fit here.

  • Transients don't get stored in PHP sessions, WP doesn't use PHP sessions at all. You should avoid PHP sessions as they don't work on a lot of hosts, and have an overhead. I'd also advise using a 3rd party service for tracking rather than implementing it from scratch yourself. For reference, transients are stored in the options table, so there is a cost. Can you ellaborate further on the context? Why are you storing the number of clicks a user makes every 10 seconds?
    – Tom J Nowell
    Oct 24, 2019 at 21:40
  • Thanks for your response. I am aware that transients are not stored in sessions. My language must be little ambiguous. Because of characters limit in comment box, I have updated my question. Please have a look. Oct 24, 2019 at 21:51
  • Ah, it's possible what you're wanting to do has already been implemented via the Limit Login Attempts plugin, or Jetpack Bruteforce protect. Keep in mind that if you store the data in sessions or cookies it'll only be available on those requests that particular user makes, a lot of failed logins are actually done by bots so neither would likely work. I also hope you're not storing the actual passwords or logins for those IPs as that's a major attack avenue for data breaches and privacy violations
    – Tom J Nowell
    Oct 24, 2019 at 21:53
  • Yes. This is something different, I just gave you an idea. I am building it for myself & would appreciate if you could clear my concepts. Oct 24, 2019 at 21:55
  • I am aware of these situations. Thanks for reminding. I am confused about whether am I misusing transients by updating them very frequently, are transients not supposed to be modified like that? or should I store normally in wp_options table, if I store normally, I have to make an arrangement for removing the keys later. Oct 24, 2019 at 22:00

1 Answer 1


For your use case, no.

  • Using PHP sessions - will not work on most hosts, and will make that data available only to the browser and the current PHP request. This severely limits the usefulness
  • Using Cookies - will work everywhere but have the same issue that you can't persist server side or track things
  • Using transients - will work to a point, you'll have a row in the options table for every visitor though, which is the crux of the issue. Transients also get garbage collected, and there's a chance that every update you make will trigger a new options row and an old transient to be cleaned up

Fundamentally the approach of storing a collection of data in an individual unit is flawed, and collecting additional data such as clicks, and the details used, will cause more problems, and in most cases be completely ineffectual:

  • There are legal complications due to privacy
  • There are security complications as misspelling a password by 1 character reveals the users password in the logs
  • Storing an IP and a username means that you've stored identifiable information, which means you have to worry about compliance with data protection laws such as the GPDR
  • Most failed login attempts are from bots, so there won't be any clicks, there may not even be a browser. They'll open a direct request bypassing the login page straight to the handler and check the response for success. Bots don't even check you're running WordPress and fire both WP/Drupal/Joomla exploits and login attempts indiscriminately
  • Failed login attempts can quick spiral out of control, with even small low traffic sites recieving spikes of hundreds or even thousands of attempts. If you're storing each visitor in a single option or transient, that could be hundreds or thousands of additional table rows. You could be constructing for yourself a resource exhaustion exploit

So instead, I would suggest:

  • tracking the minimal information possible, aka an IP and how many times it attempted, perhaps just a list of timestamps that you can count
  • Either store it in a single option, with autoload set to false so it doesn't slow down your site, or use a dedicated table
  • Thank you so much for your excellent response & covering up all the possible scenarios. Storing all IP addresses in a single option key is much better option. I've also read the "Limit login attempts" code & they also follow the same approach. Oct 24, 2019 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.