Description

LoginRateLimit is a simple and user-friendly PHP rate limiter script that blocks password brute force on login pages and admin panels.

It uses IP address based rate limiting to secure your login pages and admin panels. You can configure the max failed login attempt and after the threshold value is exceeded, LoginRateLimit automatically bans that IP address from the login page. You can configure the block duration and time window in seconds.

It is designed for beginners, small businesses and solo websites. It works on shared hosting and with any panel including cPanel, Plesk Panel and IIS. This will work on any hosting that supports PHP. No SSH or root access is required.

You don't need programming knowledge to use this script. Just put it in the same directory as your login page and add a few lines of code to your page and it will work.

More information available at GitHub repository.

Features

• Simple, easy to use and user-friendly.
• Protection against brute force attacks.
• IP address based blocking.
• Compatible with common reverse proxies such as CloudFlare.
• Can be added quickly to any PHP based admin panel or login page.

File Verification & Safety

To make sure that the tool is downloaded properly, you can check the file SHA-256 hash.

Disclaimer: This free software is provided "as-is" without warranty of any kind, express or implied. The developer assumes no liability for data misplacement or system damage resulting from improper deployment or system anomalies this tool can cause.

Change Log

1.1.0 - Released: 30/10/2026:

[+] New Features:
• You can now directly set reverseProxyEnabled option to true for reverse proxies such as CloudFlare. There is no longer a separate version for reverse proxies.
• Added reverse proxy support for Nginx Proxy and standard load balancers and proxies.

[*] Improvements:
• Now the user gets 403 error if they attempt to directly access LoginRateLimit.php.
• Changed LoginRateLimitTemp folder permission to 0700. If you have used LoginRateLimit before, you will need to delete the old storage folder.

1.0.0 - 18/10/2026:
• Initial release.