By default, if you fail to enter the correct credentials or the 2FA code five times, your IP will be blocked for a period of time.
During the lockout you will get a message like:
Your IP has been flagged for potential security violations. Please try again in a little while.
Solutions:
Solution 1: Wait for the ban duration to expire (default is 15 minutes).
Solution 2: Access the login page using the Safe URL from your WP Ghost Dashboard (Cloud Account). This will deactivate WP Ghost until you log in to the WordPress dashboard with your credentials.
Solution 3: If you have admin access via File Manager or FTP, disable the WP Ghost plugin by changing the plugin directory hide-my-wp to hide-my-wp1.
After logging in, change the hide-my-wp directory back to re-enable the WP Ghost plugin on your website and clear the blocked IP address from WP Ghost > Brute Force.