Having been locked out of my own site several times now, a whitelist for login attempts seems to be a no brainer. Honestly, why WOULDN’T you have a whitelist option for it? Really, there should be a whitelist that covers an IP for all BWPS functions, so that nothing can slip through the cracks.
Today, I was locked out inexplicably. I found my IP in the database and deleted every instance of it. Still blocked out. Nothing in htaccess. Full computer restart, even. There was nothing for it except to wait until the time expired. This just isn’t acceptable.