Is Limit Login Attempts still maintained?
Not in any meaningful sense. Limit Login Attempts has not had a release in 3 years and 6 months, which is a long silence for a plugin this widely installed. It still works on most sites today, and that is exactly what makes it easy to miss: nothing announces the day it stops.
The evidence
Every figure below is read from the WordPress.org plugin directory. Nothing here is our assessment of the code.
| Last release | 4 April 2023 (3 years and 6 months ago) |
|---|---|
| Current version | 1.7.2 |
| Tested up to | WordPress 6.2.11 (current is 7.1, 9 releases ahead) |
| Active installs | At least 300,000 sites (the directory reports a rounded floor, not an exact count) |
| Support threads resolved | No threads in the last two months |
| Directory status | Listed |
| Read from the directory | 16 September 2026 |
What these signals mean
A plugin is code running inside your site with the same privileges as WordPress itself. While its author is active that code gets adjusted when PHP raises a minimum version, when WordPress changes an API, when somebody reports a bug. When the author stops, none of that happens and the plugin keeps running, which is why a long gap is easy to miss.
The failure is almost never dramatic on the day it arrives. It is a host upgrading PHP, or a WordPress release changing a hook, and code nobody has touched in years quietly stopping. If that code is a checkout, a booking form or a member area, the first report comes from a customer.
What to do about it
Work out how much of the site depends on it before you touch anything. The cost of replacing an abandoned plugin is almost never the replacement itself, it is the data and the behaviour that came with the original.
Judge any replacement by the same signals this page reads, because a plugin that is maintained today is the only one that will still be maintained after the next WordPress release: when it last shipped, which version its author tested against, and whether anybody answers its support forum. A narrow plugin with an active author is worth more than a broader one nobody has touched in two years. You are choosing a maintainer as much as a feature set.
If nothing replaces it, the remaining options are adopting it yourself, which the GPL permits, or having a replacement built.
Is a site you look after running Limit Login Attempts?
Our free WordPress plugin checker reads any public site and lists the plugins it loads, with the same maintenance signals as the table above for each one. No login and no signup, so it works on a client’s site before you have access to it.
Maintained alternatives
From the same category in the WordPress.org directory, filtered to plugins that have shipped a release in the last year and are installed on at least 10,000 sites. Chosen by those rules rather than by us, and worth checking against the same signals before you commit to one.
- WPS Limit Login at least 100,000 sites, last updated 14 August 2026 See its maintenance signals
- Two Factor at least 100,000 sites, last updated 27 March 2026
- WP-Members Membership Plugin at least 50,000 sites, last updated 8 September 2026
Questions
When was Limit Login Attempts last updated?
The WordPress.org directory records its most recent release as 4 April 2023, which is 3 years and 6 months ago. That date is read from the directory each time this page is built, and the page states when it was read.
Should I remove Limit Login Attempts from my site?
Not as a first step, and not without knowing what it does on your site. Deactivating a plugin that has been installed for years can take out more than the feature you remember it for, and deleting it can run an uninstall routine that drops its data. Find out what depends on it, back up the database as well as the files, export anything you will need, and test the replacement on a staging copy before making the change live.
Is Limit Login Attempts a security risk?
We do not know, and nothing on this page is a security finding. Vulnerability data for WordPress plugins sits behind paid commercial APIs, and guessing at it from a version number either alarms people about plugins that are fine or implies that everything unflagged has been checked and is safe. Both are worse than saying nothing. What this page reports is maintenance: when the plugin last shipped, which WordPress version its author last tested against, how much of its support forum gets answered, and whether the directory still lists it. Those are facts the directory publishes, and they are what predicts whether a plugin will still work after the next core release.
Read from the WordPress.org plugin directory on 16 September 2026, and refreshed weekly. We report maintenance signals only, and never claim a plugin is insecure. All plugins we cover.