Core locks the account. This locks the IP that's trying all of them.
Magento already locks a storefront customer account after too many failed attempts — but only once it knows that account exists. A credential-stuffing script spraying thousands of different emails from one IP never trips it, because no single email ever fails enough times. This module throttles by IP instead, closing the gap.
Free forever, no credit card · just a free TVT Commerce account so we know where to send updates
Additive to core, not a replacement for it
Core's own customer account lockout keeps running exactly as before. This module closes the hole next to it.
Throttles by IP, not by account
Failed attempts are counted against the requesting IP address itself — before Magento even needs to know whether the email being tried belongs to a real account.
Stops enumeration tools cold
Tools that spray many different emails from one IP to find which accounts exist get blocked at the IP level, long before any single account accumulates enough failures on its own.
Covers the checkout login popup too
The standard /customer/account/login form and the inline "login" popup shown during checkout are both covered — the second one is easy to forget and just as exploitable.
Configurable time window & block duration
Set how long a window of failures counts and how long a triggered IP stays blocked — tune it to your store's real traffic, not a hardcoded default.
Configurable max attempts
Decide exactly how many failed attempts from one IP is too many before the block kicks in.
Doesn't duplicate core's lockout
Runs alongside Magento's existing per-account customer lockout rather than replacing it — you keep both layers of protection.
Why this exists: Magento's built-in customer lockout (customer/password/lockout_failures) only activates once the platform has resolved a login attempt to an existing customer account — the failure counter lives on that account's own record. A request for an email address that has never been registered never reaches that counter at all, because there's no account row to attach it to. A credential-stuffing script that sprays thousands of different, mostly non-existent emails from a single IP therefore sails straight through core's protection: no individual email ever accumulates enough failures to trip anything. This module counts failures against the IP address making the request instead of the account being targeted, so the volume of the attack itself — not which specific email happened to exist — is what triggers the block. More on the gap this closes: Why Magento's Customer Account Lockout Doesn't Stop Credential Stuffing.
Install & configure
1Download the module as a .zip from your account dashboard and copy it into app/code/TVTCommerce/LoginRateLimiter.
bin/magento module:enable TVTCommerce_LoginRateLimiter
bin/magento setup:upgrade
bin/magento cache:flush2Set your max attempts, time window, and block duration to match your traffic, then save config — it protects the login form and the checkout login popup immediately.
Closing the rest of the login surface?
This module is free and focused on one job — Login Rate Limiter protects the storefront. TVT Commerce also builds Admin Login Alert, which emails you the moment a backend admin logs in from an IP that account hasn't used before, and Disposable Email Blocker, which stops throwaway addresses at registration.