Protection against password guessing: the plugin counts failed login attempts and blocks the IP address after a set limit, while a component shows the log and address lists.
Brute Force Stop is an open-source extension by Bernhard Froehler that protects a Joomla site from password guessing. It is useful for any site with a public login form, especially when server logs show waves of login attempts against the administrator or the frontend. The package combines a plugin that watches logins and an administrator component.
Features
- The plugin records every failed login attempt.
- Once the number of failures reaches a limit set in the options, the attacker's IP address is blocked.
- The component lists blocked addresses and lets an administrator manage them, for example lift a block.
- A whitelist of IP addresses that are never blocked.
- A log of failed login attempts and a test for the notification email.
- Validation of IP addresses and subnets, and adjustable row counts in the lists.
- Interface translations in several languages, including Russian.
Compatibility
JED lists Joomla 3, 4, 5 and 6; the catalogue tracks Joomla 4, 5 and 6. The current version is 1.5.2 (component fixes for PHP below 8), last updated in JED on 26 April 2026. The source code of both the plugin and the component is published on GitHub.
