Zabezpiecz WordPress za pomocą fragmentu kodu Limit Login Attempts

Kod

<?php

// Add action to initialize the login attempt limiter
add_action('init', 'wp_dudecom_limit_login_attempts');

function wp_dudecom_limit_login_attempts() {
    if (!session_id()) {
        session_start();
    }

    // Set the maximum number of login attempts
    $max_attempts = 5;
    // Set the lockout duration in seconds (e.g., 15 minutes)
    $lockout_duration = 15 * 60;

    // Check if the user is trying to log in
    if (isset($_POST['wp-submit'])) {
        $username = isset($_POST['log']) ? sanitize_user($_POST['log']) : '';
        $password = isset($_POST['pwd']) ? $_POST['pwd'] : '';

        // Check if the login attempt is valid
        if (!empty($username) && !empty($password)) {
            $user = wp_authenticate($username, $password);

            if (is_wp_error($user)) {
                // Increment the login attempt count
                if (!isset($_SESSION['login_attempts'])) {
                    $_SESSION['login_attempts'] = 0;
                }
                $_SESSION['login_attempts']++;

                // Check if the maximum number of attempts has been reached
                if ($_SESSION['login_attempts'] >= $max_attempts) {
                    $_SESSION['lockout_time'] = time();
                }
            } else {
                // Reset the login attempt count on successful login
                $_SESSION['login_attempts'] = 0;
            }
        }
    }

    // Check if the user is locked out
    if (isset($_SESSION['lockout_time'])) {
        $time_since_lockout = time() - $_SESSION['lockout_time'];

        if ($time_since_lockout < $lockout_duration) {
            wp_die('Too many login attempts. Please try again in ' . ($lockout_duration - $time_since_lockout) . ' seconds.');
        } else {
            // Reset lockout after the duration has passed
            unset($_SESSION['lockout_time']);
            $_SESSION['login_attempts'] = 0;
        }
    }
}

// Add action to clear session on logout
add_action('wp_logout', 'wp_dudecom_clear_login_attempts');

function wp_dudecom_clear_login_attempts() {
    if (!session_id()) {
        session_start();
    }
    unset($_SESSION['login_attempts']);
    unset($_SESSION['lockout_time']);
}

?>