Brute-force login attempts are one of the most common attacks on any site with a login form, and most of the fixes are simple to implement.
Rate limit login attempts – Lock an IP or account out temporarily after several failed tries.
Add a CAPTCHA or similar challenge after a couple of failed attempts, not on every single login.
Enforce strong passwords – minimum length plus a check against common/leaked password lists.
Offer two-factor authentication – even optional 2FA dramatically reduces successful account takeovers.
Use generic error messages – "Invalid username or password" instead of confirming which one was wrong.
Log and alert on repeated failures – so you notice an attack in progress instead of finding out after the fact.
Consider a Web Application Firewall for an extra layer in front of the login endpoint entirely.
Has anyone here actually caught a brute-force attempt in progress? What tipped you off?
Last edited: