How to Secure WordPress Website from Hackers & Attacks – 6fc Live

Securing your WordPress website, such as your WooCommerce store “My Shop” (from your “Blog Page” guide) or blog hosting products like “Flying Ninja” (from your “Creating Products” guide), is critical to protect sensitive data (e.g., customer emails or verified user info from your “Email Verification” guide) from hackers and brute-force attacks. The Limit Login Attempts Reloaded plugin, featured in the 6fc Live Educate WordPress video hosted by Aisha, is a robust tool with over 1 million active installations, designed to limit login attempts and block unauthorized access. This guide details how to install, configure, and use the plugin to safeguard your site, based on the video and enriched with web sources.

Why Use Limit Login Attempts Reloaded?

• Brute-Force Protection: Limits login attempts, reducing unauthorized access by 90% (e.g., blocks bots guessing passwords like “admin”).
• WooCommerce Fit: Secures customer logins and admin access, complementing tools like Razorpay (from your “Razorpay” guide).
• Free Features: Customizable retry limits, lockout durations, and IP/username safelisting/blocklisting.
• Premium Features ($99/year): Advanced analytics, multi-site support, and country-based blocking.
• GDPR Compliance: Ensures privacy compliance (per video, aligns with your “Cookie Notice” guide).
• Limitations: Free version lacks detailed analytics; manual IP management can be complex.

Step 1: Install and Activate Limit Login Attempts Reloaded

1. Install Plugin:
   • In your WordPress dashboard, go to Plugins > Add New.
   • Search for Limit Login Attempts Reloaded (per video, by Limit Login Attempts).
   • Click Install Now, then Activate (per video).
   • Alternative: Download from wordpress.org/plugins/limit-login-attempts-reloaded/ and upload via Plugins > Add New > Upload Plugin.
2. Verify Installation:
   • Confirm: Limit Login Attempts appears in the sidebar under Settings > Limit Login Attempts (per video).
   • Check the dashboard for the plugin’s overview (per video).

Step 2: Configure Login Attempt Limits

1. Access Settings:
   • Go to Settings > Limit Login Attempts (per video).
2. Set Retry Limits:
   • Allowed Retries: Set the number of login attempts before lockout (e.g., 3 retries, per video).
     • Explanation: After 3 failed attempts, the user/IP is locked out.
   • Lockout Duration: Set the initial lockout time (e.g., 60 minutes, per video).
     • Example: 3 failed attempts trigger a 60-minute lockout.
   • Max Lockouts: Set how many lockouts before an extended lockout (e.g., 2 lockouts, per video).
     • Explanation: After 2 lockouts (6 total failed attempts), an extended lockout applies.
   • Extended Lockout Duration: Set the extended lockout time (e.g., 24 hours, per video).
     • Example: After 6 failed attempts, the user/IP is locked out for 24 hours.
   • Reset After: Set when the retry counter resets (e.g., 24 hours, per video).
     • Explanation: After 24 hours of no attempts, the retry count resets to zero.

Example Configuration (per video):
Allowed Retries: 3

Lockout Duration: 60 minutes

Max Lockouts: 2

Extended Lockout Duration: 24 hours

• Reset After: 24 hours
  • Result: 3 failed attempts → 60-minute lockout; 2 more failures → 24-hour lockout; retries reset after 24 hours.

1. Enable Notifications:
   • Notify on Lockout: Check to receive email alerts for lockouts (per video, uses registered admin email).
     • Optional: Uncheck if frequent emails are unwanted (per video).
   • Note: Premium offers advanced notifications (e.g., country details, per video).
2. GDPR Compliance:
   • Confirm GDPR compliance is enabled (per video, aligns with your “Cookie Notice” guide).
     • Displays a GDPR notice on the login page if required.
3. Save Changes:
   • Click Save Settings (per video).

Step 3: Configure Safelisting and Blocklisting

1. Access Logs and Lists:
   • Go to Settings > Limit Login Attempts > Logs (per video).
2. Safelisting (Whitelisting):
   • Add trusted IP addresses to the Safe List (per video).
     • Find your IP: Search “what is my IP” on Google (per video, e.g., 192.168.1.1).
     • Add IPs for admins or team members (e.g., your IP, fellow admins’ IPs).
     • Format: One IP per line (e.g., 192.168.1.1).
   • Note: Avoid safelisting usernames to prevent security risks (per video).
   • Benefit: Safelisted IPs bypass lockout restrictions.
3. Blocklisting (Blacklisting):
   • Add untrusted usernames to the Block List (per video).
     • Common usernames to block: admin, Aisha, A2ZShopee (per video, site-specific like “My Shop”).
     • Format: One username per line (e.g., admin).
   • Optional: Block IPs if known malicious (e.g., from logs, requires manual identification).
   • Benefit: Blocked usernames trigger immediate lockout, preventing guesses.
4. Save Changes:
   • Click Save Settings (per video).

Step 4: Test Security Features

1. Test Login Limits:
   • Log out and visit your login page (e.g., yoursite.com/wp-admin).
   • Enter incorrect credentials (e.g., username “admin”, wrong password).
   • Confirm:
     • After 3 failed attempts, see “3 attempts remaining” then “Too many failed login attempts, please try again after 60 minutes” (per video, adjusted for your settings).
     • After 5 total failures, see a 24-hour lockout message.
   • Test password reset: Verify it’s blocked during lockout (per video).
2. Test Safelisting:
   • From a safelisted IP (e.g., your IP), attempt multiple logins.
   • Confirm: No lockout occurs (per video).
3. Test Blocklisting:
   • Attempt login with a blocklisted username (e.g., “admin”).
   • Confirm: Immediate lockout or error (per video).
4. Troubleshoot:
   • Lockout Not Triggering?:
     • Verify retry settings (e.g., 3 retries, 60 minutes).
     • Clear cache (from your “Backup and Migration” guide).
   • Legitimate Users Locked Out?:
     • Check safelist for admin IPs.
     • Adjust retry limits (e.g., increase to 4).
   • Theme Conflicts?: Test with Neve or Storefront (from your “Neve” or “Creating Products” guides).
   • Email Issues?: Verify admin email in Settings > General.
   • Contact support at limitloginattempts.com/support/ or check limitloginattempts.com/documentation/.

Step 5: Enhance with Optional Features

1. Limit Login Attempts Reloaded Features:
   • Free:
     • Retry limits, lockout durations, safelisting/blocklisting.
     • GDPR-compliant lockout notices (per video).
     • Basic logs for failed attempts.
   • Premium ($99/year):
     • Detailed analytics (e.g., country, IP details, per video).
     • Multi-site and forum support.
     • Advanced blocking (e.g., by country or traffic patterns).
   • Purchase at limitloginattempts.com/premium/.
2. WooCommerce Integration:
   • Protect customer logins (e.g., for “Flying Ninja” purchases).
   • Pair with NotificationX for security alerts (from your “NotificationX” guide).
   • Secure payments with Razorpay or UPI QR Code (from your “Razorpay” or “UPI Payment” guides).
   • Enhance login forms with reCAPTCHA (from your “reCAPTCHA” guide).
3. Additional Security:
   • Use Wordfence for comprehensive protection (from your “Malware Removal” guide).
   • Add Google reCAPTCHA to login forms (from your “reCAPTCHA” guide).
   • Implement GDPR Cookie Consent for compliance (from your “Cookie Notice” guide).
4. Custom Styling:
   • Style lockout messages in Appearance > Customize > Additional CSS:
     .llar-error { background: #ffe6e6; color: #d32f2f; padding: 10px; border-radius: 5px; }

.llar-notice { font-size: 14px; }

@media (max-width: 600px) { .llar-error { padding: 8px; } }

• Align with Neve’s design (from your “Neve” guide).

Step 6: Best Practices

1. Login Security:
   • Avoid common usernames (e.g., “admin”, “Aisha”, per video); use unique ones (e.g., “user123_”).
   • Blocklist common usernames (e.g., “admin”, site-specific names like “A2ZShopee”).
   • Safelist only trusted IPs (e.g., your admin IP).
2. User Experience:
   • Set reasonable retry limits (e.g., 3-4) to avoid locking out legitimate users.
   • Provide clear error messages (e.g., “Try again after 60 minutes”).
   • Offer password reset links outside lockout periods.
3. Testing:
   • Test lockouts in incognito mode to simulate attacker behavior.
   • Verify safelist/blocklist functionality.
   • Check email notifications (if enabled).
4. Performance:
   • Plugin is lightweight; cache login pages (from your “Backup and Migration” guide).
   • Monitor dashboard load with GTmetrix.

Pro Tips

• Engagement: Promote secure logins with a Welcome Bar (from your “Sticky Menu” guide) or Join.chat for support (from your “Join.chat” guide).
• Security: Combine with Wordfence for malware scanning (from your “Malware Removal” guide).
• Compliance: Ensure GDPR compliance with GDPR Cookie Consent (from your “Cookie Notice” guide).
• SEO: Secure site to maintain rankings with Yoast SEO (from your “Yoast SEO” guide).
• Backup: Save settings with UpdraftPlus (from your “Backup and Migration” guide).
• Styling: Match lockout notices with Neve’s design (from your “Neve” guide).

Congratulations!

You’ve secured your WordPress website from hackers and attacks with Limit Login Attempts Reloaded and 6fc Live! Your site is now protected against brute-force attacks, safeguarding customer data and admin access. For advanced analytics or multi-site support, explore the Premium version (limitloginattempts.com). Combine with your other guides (e.g., “Wordfence,” “reCAPTCHA,” “Neve”) for a robust platform. Need help with setup, IP management, or troubleshooting? Comment below or visit limitloginattempts.com/support/!