I don't run a WordPress site, but it seems to me that failed password lockouts should be a standard feature. Even a lockout of say five minutes makes brute-forc

I don't run a WordPress site, but it seems to me that failed password lockouts should be a standard feature. Even a lockout of say five minutes makes brute-forcing all but the most useless passwords implausible. I looked up Wordfence. The way it preemptively blocks attacks from all domains that attack any Wordfence user's site is pretty clever.