Locked Out: Too Many Failed Login Attempts (2026)
Disclosure: some links on this page are affiliate links. We may earn a commission at no extra cost to you. How we test and rate hosts.
Your security plugin did its job a little too well: you're locked out of your own site. Whether it's "too many failed login attempts" from a plugin, a server-level ban, or a hosting firewall, the way back in depends on who locked the door.
Step 1: Read the Lockout Message
The exact wording tells you the owner: "This feature is provided by Limit Login Attempts Reloaded" = plugin. A generic "your IP has been blocked" = server firewall. "Access denied by Wordfence" or a Cloudflare challenge = WAF. Different lock = different key.
Plugin Lockout: Disable via FTP
The lockout logic lives in the plugin - remove the plugin, remove the lock. Via FTP or file manager, go to wp-content/plugins and rename the lockout plugin's folder: limit-login-attempts-reloaded → limit-login-attempts-reloaded_off. Same for wordfence, ithemes-security, sucuri. Log in immediately, rename it back, reactivate, and fix the settings before it locks you out again.
Server-Level Ban: Your IP Is Blocked
fail2ban, Imunify, and mod_security ban at the network level - renaming plugins won't help. Three routes:
- New IP: phone hotspot, VPN, or router restart - then whitelist the new IP in the plugin before it bans again
- Host ticket: "unban my IP [your ip]" - support does this in minutes
- Your own firewall: on VPS, remove the ban via CSF/LFD panel or iptables
Stop Digging: Set the Password Directly
Every failed attempt extends the timer. Instead of guessing: phpMyAdmin → wp_users → Edit your user → user_pass = new password, function = MD5 → save. You now KNOW the password - one clean login and you're in. Full steps in the password reset guide.
Configure It Right So It Doesn't Happen Again
- Whitelist your IP in the lockout plugin - most have a whitelist field you skipped during setup
- Raise the threshold to 5-10 attempts, not the aggressive default
- Use 2FA on admin accounts - bots fail at factor two, you never get locked out for their attempts
- Separate accounts - one admin per person, no shared logins hitting concurrent session limits
Keep Reading
- Password reset not working - the phpMyAdmin method in detail
- Login redirect loop - the other "can't get in" problem
- wp-admin not loading - blank dashboard variant
- Hacked recovery - if the lockouts were triggered by a real attack
- Bluehost review 2026
What are you building?
Tell us about your project so we can match the perfect hosting plan.
Hosting Cost Calculator
See exactly how much you'll spend on hosting over time. Compare Bluehost vs popular alternatives and discover your potential savings.
Used to calculate transaction fees (Shopify charges 2% on sales)
Frequently Asked Questions
How long does a WordPress login lockout last?
It depends entirely on which plugin or feature caused it - there's no universal timer. Limit Login Attempts plugins default to 20 minutes to 24 hours; Wordfence's lockout can be minutes to days; your host's server-level firewall (fail2ban, Imunify) may block longer. The lockout message usually states the duration.
How do I bypass my own login lockout?
Rename the responsible plugin's folder via FTP - wp-content/plugins/limit-login-attempts-reloaded (or wordfence, ithemes-security, etc.) → name it _off, log in, then rename it back and configure it correctly. This works because the lockout logic lives in the plugin.
What if it's a server-level block, not a plugin?
fail2ban, Imunify360, or a WAF banned your IP at the network level - no plugin to disable. Fix: contact the host to unban your IP, or get a new IP (restart router, use VPN, phone hotspot). For your own VPS, unban via the firewall panel or iptables.
How do I get in WITHOUT triggering more lockouts?
Stop guessing passwords - each failure resets or extends the timer. Use the phpMyAdmin method to set a known-good password directly in the database (MD5 function on user_pass), then log in once, correctly. The password reset guide has the exact steps.
Should I even use a lockout plugin?
Yes - but configure it right. Whitelist your own IP, set reasonable thresholds (5-10 attempts, not 2), and use application passwords or 2FA on admin accounts so bots can't lock you out by trying your username repeatedly. A plugin that locks YOU out is protecting nobody.
Ready to launch?
Get Bluehost from $3.99/month with a free domain, free SSL, and 30-day money-back guarantee.
Related Articles
Bluehost vs Competitors: The Technical Deep Dive
We ran 47 benchmarks over 90 days. Here's the raw data on why Bluehost dominates.
Fix ERR_TOO_MANY_REDIRECTS in WordPress (2026): The 6 Real Causes
ERR_TOO_MANY_REDIRECTS means an infinite redirect loop. Match your Site URLs, fix Cloudflare SSL mode, reset .htaccess, kill plugin conflicts - step-by-step with code.
WordPress 403 Forbidden Error: 7 Fixes That Actually Work (2026)
403 means the server understood you but refuses to serve the page. Fix file permissions (755/644), regenerate .htaccess, kill security plugin blocks - in the right order.
Fix 502 Bad Gateway in WordPress (2026): Diagnose First, Then Fix
502 means the gateway got a bad response from your server - usually PHP timeouts, CDN issues, or overload. A 9-step diagnostic workflow from browser checks to server logs.
Fatal Error: Maximum Execution Time Exceeded - 6 Fixes (2026)
max_execution_time kills slow updates at 30-60s. Fix the culprit plugin/theme first, then raise the limit via wp-config, .htaccess or php.ini - with exact code.
HTTP Error Uploading Images in WordPress: 9 Fixes Ranked (2026)
The vague 'HTTP error' on image upload usually means memory limits or Imagick. Fix order: rename the file, bump memory, force GD library, check permissions - with code.