Fix: “You have exceeded maximum login retries” in WordPress (Loginizer Plugin)

By /

Summary This document outlines the emergency recovery procedure to bypass the “maximum login retries” lockout caused by the Loginizer plugin, allowing administrators to regain access to the WordPress dashboard and optionally reset administrator credentials via the file system.

Environment

  • WordPress (Latest Version)
  • CyberPanel / LiteSpeed Web Server
  • Plugin: Loginizer v2.0.8

Problem The system administrator is locked out of the WordPress backend (wp-admin). The authentication portal is entirely blocked, preventing any administrative tasks or credential verification.

Symptoms

  • The login screen does not load the username/password fields.
  • The frontend restricts the user based on their IP address.

Error Message

You have exceeded maximum login retries
Please try after 2 hour(s)

Root Cause The Loginizer plugin actively monitors failed login attempts to mitigate brute-force attacks. After a predefined threshold of incorrect attempts, it blacklists the originating IP address. Legitimate administrators can trigger this by forgetting credentials or due to conflicting caching layers (like LiteSpeed) passing incorrect IP headers, causing the plugin to block the administrator’s IP.

Solution To resolve this issue, the lockout must be bypassed at the file-system level, followed by an optional emergency credential reset.

Phase 1: Bypass Plugin Restrictions via File System

  1. Log in to your CyberPanel dashboard and navigate to the File Manager.
  2. Access the WordPress plugins directory: public_html/wp-content/plugins/.
  3. Locate the loginizer directory.
  4. Right-click the folder and select Rename.
  5. Change the name to loginizer-off and save. (Why this works: Renaming the folder forces WordPress to automatically deactivate the plugin, which instantly lifts the IP restriction without requiring database queries).

Phase 2: Emergency Admin Account Creation (If Credentials are Lost) If you are unable to remember the correct password, you can force-create a new administrator account using a standalone script.

  1. In the root directory (public_html), create a new file named new-admin.php.
  2. Insert the following PHP code:
<?php
require_once('wp-load.php');

$username = 'modir2026';
$password = 'MyNewPassword123!';
$email = 'test@example.com'; 

if ( !username_exists($username)  && !email_exists($email) ) {
    $user_id = wp_create_user( $username, $password, $email );
    $user = new WP_User( $user_id );
    $user->set_role( 'administrator' );
    echo 'New administrator account created successfully! You can now log in.';
} else {
    echo 'This username already exists.';
}
?>
  1. Execute the script by visiting [https://[your IP or Domain]/new-admin.php] in your browser.

Phase 3: Cleanup and Restoration

  1. Navigate back to [https://[your IP or Domain]/wp-login.php]. The error will be gone.
  2. Log in using your existing credentials or the newly created emergency credentials.
  3. Return to the CyberPanel File Manager and rename loginizer-off back to loginizer.
  4. Critical Security Step: Delete the new-admin.php file from your server immediately to prevent unauthorized access.

Verification

  • The wp-admin dashboard is fully accessible.
  • The Loginizer plugin is successfully reactivated from the WordPress backend without instantly locking the administrator out.

Lessons Learned

  • Relying solely on frontend authentication is risky; always maintain file-level (CyberPanel/SSH) access for emergency interventions.
  • Standalone PHP scripts interacting with the WordPress core (wp-load.php) are powerful recovery tools but pose a severe security vulnerability if left on the server after the incident is resolved.

References

  • Loginizer Official Documentation: Brute Force Protection
  • WordPress Codex: Resetting Your Password

Related Articles

  • (Currently, there are no related articles in this category. This section will be updated as more internal documentation is published.)
Scroll to Top