# 10 MB of state holds roughly 160,000 addresses
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
server {
location = /wp-login.php {
limit_req zone=login burst=3 nodelay;
limit_req_status 429;
include fastcgi_params;
fastcgi_pass unix:/var/run/php5-fpm.sock;
}
}