How to Fix Limit Login Attempts Reloaded Not Sending Email

Is Limit Login Attempts Reloaded not sending email? Those lockout alerts are how you find out someone’s trying to break into your site.

The plugin does a great job of blocking brute force attacks. But it relies on your site’s email setup to send its alerts. That’s where things often break.

In this guide, I’ll show you how to get those alerts back into your inbox.

Fix Your WordPress Emails Now

Why Limit Login Attempts in WordPress?

Hackers sometimes try to break into WordPress sites by logging in over and over.

Most use software that tries thousands of username and password combinations in minutes. That’s a brute force attack.

The Limit Login Attempts Reloaded plugin counts failed logins from each IP address. After too many, it locks that visitor out.

Here are the emails the plugin sends from your site:

• Lockout alerts: a “Login blocked from [IP]” email when an IP gets locked out.
• Email Digests: optional daily, weekly, or monthly recaps of lockouts.
• 2FA codes: one-time login codes, if you turn on the plugin’s 2FA.
• Test email: sent from the settings page when you click the test button.

All 4 go through WordPress’s built-in wp_mail() function. So if your site can’t send email, none of them arrive.

The 2FA codes matter most. If they don’t arrive, you can lock yourself out of your own site.

If you aren’t getting these emails, the steps below will fix that.

How to Fix Limit Login Attempts Reloaded Not Sending Email

Limit Login Attempts Reloaded sends its lockout alerts, digests, and 2FA codes through WordPress’s wp_mail() function. Many web hosts block or don’t authenticate that mail, so the emails never arrive.

To fix it, check the plugin’s Notify on lockout settings first. Then send your site’s email through an SMTP provider with WP Mail SMTP.

Step 1: Check Your Limit Login Attempts Reloaded Settings

First, let’s make sure the plugin sends lockout emails to the right address.

Before you start, you’ll need:

• Admin access: an administrator login for your WordPress site.
• The plugin: Limit Login Attempts Reloaded installed and active.

Log in to your WordPress dashboard. In the left menu, go to Limit Login Attempts » Settings.

In Limit Login Attempts Reloaded 3.3, the email settings live under App Settings. Scroll to that section and open Local App if it’s collapsed.

The first row is Notify on lockout. Here’s what to check:

• Email to: make sure this box is checked. If it’s unchecked, the plugin sends no lockout emails at all.
• Email address: it’s pre-filled with your site’s admin email. Replace it if you want alerts to go somewhere else.
• after [N] lockouts: how many lockouts happen before your first email. The default is 3.

Keep in mind that the trigger is lockouts, not failed logins. With the default settings, each lockout takes 4 failed attempts.

So the first email goes out after 12 failed logins from the same IP. The plugin’s wordpress.org listing recommends keeping these defaults.

That’s why you won’t get an email for a single wrong password. That’s normal.

Click Save Settings if you changed anything.

Now click Test Email Notifications. You should see “Test email has been sent!”

Then check your inbox for an email with the subject LLAR Security Notifications [TEST].

If the test never arrives, your settings are fine. The problem is how your site sends email, and we’ll fix that next.

Step 2: Install the WP Mail SMTP Plugin

Next, we’re going to install the WP Mail SMTP plugin on your site.

By default, WordPress sends email through your web host’s server. Inbox providers often block those emails or send them to spam, because they aren’t authenticated.

WP Mail SMTP sends them through a proper email provider instead. That adds the authentication inbox providers look for.

That fixes your lockout alerts. It also fixes your contact form emails, WooCommerce order notifications, and Wordfence alerts.

You can start with the free version. Go to Plugins » Add Plugin, search for “WP Mail SMTP”, and click Install Now.

For WP Mail SMTP Pro, log in to your WP Mail SMTP account. Download the zip file from the Downloads tab.

Then go to Plugins » Add Plugin and click Upload Plugin. Choose the zip file and click Install Now.

If you need help, see this guide to installing a WordPress plugin.

Click Activate once it’s installed. The Setup Wizard opens right away.

If you want to pause here, you can restart it later. Go to WP Mail SMTP » Settings and click Launch Setup Wizard.

Step 3: Set Up Your Email Service

Now let’s run the Setup Wizard. It connects your WordPress site to an email provider.

Click Let’s Get Started to begin.

Next, you’ll see the Choose Your SMTP Mailer screen. SendLayer sits at the top as the Recommended option.

Its Quick Connect button sets it up for you.

Not sure what to pick? Here are a few tips:

• Busy sites: SendLayer, SMTP.com, and Brevo (formerly Sendinblue) handle large volumes well.
• Small sites: a Gmail or Google Workspace account works fine. You can even use a Gmail alias to send your WordPress emails.
• Other SMTP: connect any SMTP server you have access to. Some providers cap how many emails you can send.

Amazon SES, 365 / Outlook, and Zoho Mail need WP Mail SMTP Pro.

Our complete guide to email providers compares the pros and cons of each.

After you pick a mailer, open its setup doc. It walks you through the steps on the provider’s side:

• SendLayer
• SMTP.com
• Brevo
• Amazon SES
• Elastic Email
• Google Workspace / Gmail
• Mailgun
• Mailjet
• MailerSend
• Mandrill
• Microsoft 365 / Outlook.com
• Postmark
• Resend
• SendGrid
• SMTP2GO
• SparkPost
• Zoho Mail
• Other SMTP

Want more than one mailer? Once the wizard’s done, you can add Additional Connections.

Then pick a Backup Connection and set up Smart Routing. These are Pro features.

For lockout alerts, a backup connection is worth it. If your main mailer fails during an attack, the alert still goes out.

When you’ve finished on your provider’s side, come back here to turn on email logging.

Step 4: Turn on Email Logging (Optional)

With WP Mail SMTP Pro, I’d turn on Detailed Email Logs. It keeps a record of every email your site sends, including each lockout alert.

The log tells you which happened. “The email never sent” looks different from “it sent, but went to spam.”

You’ll find it near the end of the wizard. WP Mail SMTP asks Which email features do you want to enable? 2 are already on:

• Improved Email Deliverability: helps your emails send reliably through your mailer.
• Email Error Tracking: helps you spot errors that stop emails from sending.

Leave both on. They’re what fix the lockout emails.

Pro also adds a dashboard widget. It charts sent and failed emails, so problems stand out quickly.

The Weekly Email Summary sends a recap of your email stats to your inbox each week.

And Instant Email Alerts tell you when your site fails to send an email. You can get them by email, SMS, Slack, or webhook.

Turned on Detailed Email Logs? The next screen lets you store email content and attachments.

You can also track opens and link clicks.

Our guide on how to log your WordPress emails covers the log settings in more detail.

Step 5: Send a Test Lockout Email

Go back to Limit Login Attempts » Settings and click Test Email Notifications again. This time, the test should land in your inbox within a minute or so.

If you have Pro, open WP Mail SMTP » Email Log. Search for “LLAR” and you’ll see the test email and its status.

Real lockout alerts show up in the log with the subject “[your site] – Login blocked from [IP].” That makes them easy to find later.

On the free version, you can also run a test from WP Mail SMTP » Tools » Email Test. It also checks your domain’s DNS records.

Troubleshooting Limit Login Attempts Reloaded Emails

If the test works but real alerts still don’t show up, check these.

The Email To Box Is Unchecked

Saving the settings with Email to unchecked turns off lockout emails completely. Go back to Step 1 and check the box.

You Haven’t Hit the Lockout Threshold Yet

Remember the default math: each lockout takes 4 failed attempts. The first email comes on the 3rd lockout, after 12 failed logins.

A few wrong passwords won’t trigger anything. Check Limit Login Attempts » Logs to see recent lockouts.

2FA Codes Aren’t Arriving

The plugin’s 2FA sends one-time codes by email only. Fix your email setup before you turn 2FA on.

A caching plugin that caches or minifies your login page can break the code flow. Recent versions show an admin notice when they detect this.

If you see it, exclude your login page from caching.

You’re Using the Cloud App

Cloud App lockouts aren’t emailed from your site, so WP Mail SMTP won’t affect them. Check your LLAR cloud dashboard for alerts instead.

The free plugin runs as the Local App. This only applies if you’ve switched Active App to a Cloud App plan, like Micro Cloud.

And that’s it! Now you know how to get your lockout alerts delivered again.

Get Every Security Alert Delivered

Next, Set Up a DMARC Record

Now that your Limit Login Attempts Reloaded alerts are working, check your DNS. Your email provider may require a DMARC record for your domain.

If you don’t have one, you’ll see a warning like this in WP Mail SMTP’s Email Test:

DMARC tells receiving servers what to do with emails that fail SPF or DKIM checks. Our guide on how to create a DMARC record walks you through it.

Ready to fix your emails? Get started today with the best WordPress SMTP plugin. If you don’t have the time to fix your emails, you can get full White Glove Setup assistance as an extra purchase, and there’s a 14-day money-back guarantee for all paid plans.

If this article helped you out, please follow us on Facebook and Twitter for more WordPress tips and tutorials.