Information checked: 21 July 2026.
Brute-force protection should address password guessing, password spraying and credential stuffing without locking legitimate users out indefinitely. The strongest defence is not a hidden login URL; it is secure authentication and controlled recovery.
In brief: MFA and secure recovery provide stronger protection than simply blocking an IP address after several attempts.
Protect the accounts that matter most
- Require MFA for domain, hosting, email, CMS and payment administration.
- Use unique passwords and block known-compromised choices where supported.
- Remove shared accounts and disable dormant users.
- Protect password-reset and account-recovery routes as carefully as login.
Use measured automated controls
Authentication controls
- Rate limiting
- Purpose: Slows automated attempts; Operational caution: Avoid permanent denial of service to one user or network
- Progressive delay
- Purpose: Adds increasing cost to repeated failures; Operational caution: Keep the response understandable
- Risk-based challenge
- Purpose: Adds friction to suspicious attempts; Operational caution: Provide an accessible alternative
- Alerting
- Purpose: Surfaces attacks on privileged accounts; Operational caution: Avoid alert floods that hide real events
- MFA
- Purpose: Limits value of a stolen password; Operational caution: Secure enrolment and recovery
Investigate patterns, not only counts
Look for many accounts tried from one source, one account tried from many sources, successful login after repeated failures and changes to recovery details. Preserve timestamps and account identifiers for investigation.
Acceptance check
Test failed attempts, a legitimate forgotten-password journey, MFA recovery and administrator alerts. Confirm that controls do not disclose whether a username exists.
Avoid turning defence into denial of service
A permanent lockout after a few failures can be abused to block staff or customers. Prefer progressive delays, risk signals, MFA and secure recovery. Alert on successful privileged access after suspicious failures, not only on the number of attempts.
Records to keep
- Authentication policy and MFA coverage.
- Lockout or throttling configuration.
- Administrator alert route.
- Recovery and identity-verification procedure.
Owner test: Test a legitimate user who forgets a password and confirm they can recover safely without revealing whether other accounts exist.
Sources and date checked
This practical guidance was checked against the following primary sources. Date checked: 21 July 2026.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.