Avoid multiple logins without additional plugins/tools. Must have a login feature enabled on the site. Test with 5+ wrong passwords. If locked out: Clear transients Or Change IP (restart router / use VPN)
function wpf_limit_login_attempts() {
$ip = $_SERVER['REMOTE_ADDR'];
$key = 'wpf_login_' . md5( $ip );
$attempts = (int) get_transient( $key );
if ( $attempts >= 5 ) {
wp_die( 'Too many login attempts. Try again later.' );
}
set_transient( $key, $attempts + 1, 15 * MINUTE_IN_SECONDS );
}
add_action( 'wp_login_failed', 'wpf_limit_login_attempts' );