*Block login after 3 failed attempts.

/**

 * Block login after 3 failed attempts.

 */

function block_login_after_three_attempts() {

    $login_lockout = get_option( 'login_lockout', array() );

    // Get the user's IP address.

    $user_ip = $_SERVER['REMOTE_ADDR'];

    // Check if the user's IP address is already in the lockout array.

    if ( isset( $login_lockout[$user_ip] ) ) {

        // Check if the lockout time has expired.

        if ( time() - $login_lockout[$user_ip]['last_attempt'] > 60 * 60 ) { // 1 hour lockout

            // Reset the attempt count AG.

            $login_lockout[$user_ip]['attempt_count'] = 0;

        }

    }

    // Increment the attempt count if the login failed.

    if ( isset( $_POST['wp-submit'] ) && ! is_user_logged_in() ) {

        if ( ! isset( $login_lockout[$user_ip] ) ) {

            $login_lockout[$user_ip] = array(

                'attempt_count' => 1,

                'last_attempt' => time(),

            );

        } else {

            $login_lockout[$user_ip]['attempt_count']++;

            $login_lockout[$user_ip]['last_attempt'] = time();

        }

        // Block the user if the attempt count exceeds 3 you can adjust the number of attempts.

        if ( $login_lockout[$user_ip]['attempt_count'] >= 3 ) {

            // Store the lockout time in the option.

            update_option( 'login_lockout', $login_lockout );

            // Display an error message to the user.

            wp_die( __( 'Sorry son,You have exceeded the maximum number of login attempts. Please try again later.', 'your-text-domain' ) );

        }

    }

    // Store the updated lockout array in the option.

    update_option( 'login_lockout', $login_lockout );

}

add_action( 'authenticate', 'block_login_after_three_attempts', 10, 3 );