Limit Login Attempts Reloaded alternative: switch to BetterShield
To switch from Limit Login Attempts Reloaded to BetterShield, install BetterShield beside it, preview the import, apply the limits and allowed addresses it can match, check how the site sees visitors, test a sign-in, and only then deactivate the old plugin. BetterShield reads the settings Limit Login Attempts Reloaded left on the site, names anything it cannot carry, and never changes the other plugin until you choose to.
This post is for someone who has already decided to move. If you are still weighing it, how to switch WordPress security plugins without lockouts covers the general order, and how to limit login attempts in WordPress explains the limits themselves. Here we stay with one move and say what carries over, what to check, and how to undo it.
Quick summary
- The import carries the sign-in limits and the allowed IP addresses that Limit Login Attempts Reloaded was using.
- A preview comes first and changes nothing. It also names anything that cannot move.
- Importing settings and deactivating a plugin are two separate actions, so you decide when the old plugin stops.
- Check how the site identifies visitors behind a proxy before you rely on the limits, or one visitor’s mistakes can look like everyone’s.
- BetterShield does not run a firewall, does not block by country and does not scan for malware, so none of those jobs move.
Why the order matters
For a while, two plugins are active on the same site. If both count failed sign-ins, the same person can be paused by either one, and a lockout can feel like a mystery. The order below keeps one plugin in charge of sign-in limits at every moment, which is the whole point of doing this carefully.
Two active limiters can pause the same person independently, so we recommend choosing one to keep in charge, then moving.
What carries over
The doc for this switch is short on purpose, and so is the list. BetterShield imports:
| In Limit Login Attempts Reloaded | In BetterShield |
|---|---|
| Its login limits | The sign-in limits under Sign-in attempt limits, with Failures allowed, Counted within (minutes) and Lockout lasts (minutes) |
| Its allowed IP addresses | Always allowed |
Whatever BetterShield cannot carry is named in the preview, so nothing is dropped without a word. Nothing else in Limit Login Attempts Reloaded is read or described here.
For comparison, BetterShield’s own defaults are 5 failed sign-ins in 15 minutes, which lock that connection out for 15 minutes, doubling with each repeat within a day. The account itself is never locked, so its owner can still sign in from anywhere else. Sign-in lockouts lists every option and its range: 3 to 100 failures, and 1 to 1440 minutes for each time.
What does not move, and what BetterShield does not do
Say it plainly before you deactivate anything:
- A firewall. BetterShield does not run one.
- Country blocking. BetterShield does not block by country.
- Malware scanning. BetterShield does not scan for or remove malware.
- Anything the preview names as not carried. Read that list and decide, setting by setting, whether you need to recreate it by hand.
If you rely on another plugin or service for any of those jobs, keep it. Run BetterShield alongside another security plugin explains how the two share the work.
Before you start: keep a way back in
Make sure you can get back in without the dashboard. BetterShield emails a single-use recovery link to the site’s administration address when you activate it. We recommend checking that the email arrived, and storing the link or your recovery codes outside the site, before you change anything else. Locked out of WordPress? shows what using it looks like.
Behind a proxy or Cloudflare: check this first
Sign-in limits act on an address BetterShield can verify. Behind a reverse proxy, a load balancer or a CDN, every request can arrive from the same address, so BetterShield has to be told whom to believe. A wrong setup can make visitors share one apparent address, and then one person’s typos pause everyone.
On BetterShield › Protection › Login & Access, the How this site sees you card shows what BetterShield sees. The short version:
| Your setup | What to do |
|---|---|
| Hosted directly | Nothing to set. |
| Behind Cloudflare | Confirm it when the card asks, and only if it is true. |
| Behind a load balancer or a host’s proxy | Name only that proxy’s own addresses under Addresses of your CDN or proxy, and make sure it sends the visitor’s address in an X-Forwarded-For header. |
Until visitors can be told apart, BetterShield records failed sign-ins but pauses nobody, which is the safe choice. Proxies and Cloudflare has the full table, and WordPress behind Cloudflare or a proxy: get the visitor’s real IP walks through it with examples.
Set it up: switch over step by step
- Install and activate BetterShield, leaving Limit Login Attempts Reloaded active. Keep recovery ready first, as above.
- In Quick Setup, open the Coexistence step and read the settings it recognizes. Choose which plugin handles sign-in limits for now. Already finished Quick Setup? The same import is on Settings › General.
- On Settings › General, find Move settings between sites. Another plugin’s settings appear as (active) or (not active) beside a Preview Import button.
- Press Preview Import. Nothing changes yet. Review the proposed limits and allowed addresses, and read anything named as not imported.
- Check how the site identifies visitors behind a proxy, as in the section above.
- Apply the import when you are ready to live with every row.
- Choose the offered Deactivate action only when you are ready to stop every feature of Limit Login Attempts Reloaded. If the wizard cannot deactivate it, use the Plugins screen with an authorized account.
- Test a normal sign-in while your existing administrator session stays open.
Switch from Limit Login Attempts Reloaded to BetterShield is the step-by-step reference, and Move settings between sites covers the import screen itself. The WordPress.org plugin documentation explains deactivating a plugin from the Plugins screen.
Check it is working
- Open BetterShield › Protection › Login & Access and confirm Failures allowed, Counted within (minutes) and Lockout lasts (minutes) show numbers you are happy with.
- Confirm the Always allowed list holds the addresses you expect, such as an office with a fixed address.
- Confirm Visitor addresses in the summary reads Readable. If it does not, the card explains why lockouts are off, with a See why link.
- From a phone on mobile data, sign in to a test account with a wrong password until the limit is reached. Watch the lockout appear in the Lockouts list, then release it with Release Now. The activity log records “Sign-in lockout started” and “Sign-in lockout cleared”.
What it can break, and how to undo
- Two active limiters. They can pause the same person independently. Keep one in charge until the switch is finished.
- A wrong proxy setup. Visitors can share one apparent address. Fix the proxy entry on Login & Access, or remove it, and save.
- An office behind one address. Everyone there shares one connection, so one person’s typos affect all of them. Add the fixed address to Always allowed, or press Release Now.
To undo the import, use BetterShield’s recorded settings undo. Press Put it back on the row for the change on Settings › General. It restores only what the import changed, and asks you to put any newer change to those settings back first. A settings undo does not reactivate a plugin: if you want Limit Login Attempts Reloaded back, reactivate it on the Plugins screen. Its own settings are never changed by BetterShield, so nothing needs restoring there.
Recommended settings
We recommend keeping the previous plugin’s settings until the new setup is verified, using one sign-in limiter at a time, and starting from the preview rather than copying numbers blindly. Once the check above passes, deactivate the old plugin, run a normal sign-in test, and keep your recovery link where you can find it. For a site where many people share one office or school network, add its fixed address to Always allowed rather than raising the limit for everyone. Allow and block lists describes both lists.
Frequently asked questions
Does BetterShield change Limit Login Attempts Reloaded during the import?
No. BetterShield reads the settings the other plugin left on the site and does not change or deactivate it. Importing settings and deactivating a plugin are separate actions, and you choose when to do the second.
Does the import carry my allowed IP addresses?
Yes. Allowed IP addresses are one of the two things it carries, and they land in Always allowed. The preview names anything it cannot carry, so you can add it by hand.
Can I run both plugins at the same time?
Only for a short while, with one plugin in charge of sign-in limits. Two active limiters can pause the same person independently, so we recommend finishing the switch rather than leaving both on.
What if the wizard cannot deactivate the old plugin?
Use the Plugins screen with an account that is allowed to deactivate plugins. The import is already done by then, so deactivating is the only step left.
Can I go back if something looks wrong?
Yes. Press Put it back on the row for the change to undo the imported settings, and reactivate Limit Login Attempts Reloaded from the Plugins screen if you want its own behavior back.
Conclusion
Switching from Limit Login Attempts Reloaded comes down to a short order: keep a way back in, preview the import, check how the site sees visitors, apply the limits and allowed addresses, test a sign-in and only then deactivate the old plugin. The import carries what matches and says plainly what does not, and every change can be taken back.
BetterShield is free on WordPress.org. The step-by-step reference is Switch from Limit Login Attempts Reloaded to BetterShield.