How can I protect login pages from brute-force attacks?
Asked on Sep 25, 2025
Answer
To protect login pages from brute-force attacks, implement rate limiting and account lockout mechanisms, and consider using CAPTCHA or multi-factor authentication (MFA).
<!-- BEGIN COPY / PASTE -->
# Example of a rate limiting configuration using Nginx
http {
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
server {
location /login {
limit_req zone=one burst=5;
# Other configurations
}
}
}
<!-- END COPY / PASTE -->Additional Comment:
- Rate limiting helps to slow down repeated login attempts from the same IP address.
- Account lockout after a number of failed attempts can prevent automated attacks but should be used carefully to avoid denial-of-service risks.
- Implementing CAPTCHA can help differentiate between human users and bots.
- Multi-factor authentication adds an extra layer of security, making it harder for attackers to gain unauthorized access.
✅ Answered with Security best practices.
Recommended Links: