This issue has been fixed in BPS 2.9 and BPS Pro 13.4.1. There is an additional existing issue that is acceptable: If someone has the Max Login Attempts option setting set to 5 login attempts then on first login attempts the Attempts Remaining option setting will display: 4, 3, 2, 1, 0. After the lockout time expires and the user attempts to login again the Attempts Remaining option setting will display: 5, 4, 3, 2, 1, 0. The user will get an additional login attempt. This is necessary since the checking conditions are below. Using >= is not an option with the existing BPS Login Security code since it would negate the user account lock when max logins is reached.
Note: It would be possible to create separate primary conditional code for: failed_logins == $BPSoptions['bps_max_logins'] and $failed_logins > $BPSoptions['bps_max_logins'], but that would require significant additional coding work for something that is a very minor issue.
if ( $failed_logins == $BPSoptions['bps_max_logins'] ) { $status = 'Locked'; }
and
if ( $failed_logins > $BPSoptions['bps_max_logins'] ) { $status = 'Not Locked'; }
.
