Some gripes about this plugin

The reason i installed this plugin over login lockdown was the fact it also tracks/blocks xmlrpc login attempts. I was certainly displeased with the fact that it would make logins take longer and longer on accounts with failed attempts despite the footprint of the user making the request.
I assumed that it would only take longer for users making the same failed requests from like the same IP/UA combo but while my account was under attack i was forced to wait for the delayed login and had to reset my password before it let me in. I suggest adding the login delay only for the same footprint as previously failed requests and/or possibly adding exempt from delay IPs. I also would like it if i can say to outright deny IPs if they have X amount of failed attempts rather then let them try all day over and over even if they would never get in due to the password change policy.

Thanks

https://ww.wp.xz.cn/plugins/login-security/