In reply to Morten R-H (@mor10).

Well said and I think it's very much the same conversation.

I always assumed most login forms on the Internet limited login attempts. Since WordPress doesn't, I have to doubt that. I sure hope my bank does. I can't think of a reason why WordPress, powering such a portion of websites, should not limit login attempts. This is a simple and effective security measure.