Security measures proposal - User login brute force prevention, and more

[michaeld (Michael - Communiteq)]

@Lid

After 10 failed attempts, transparently deactivate logins for this account for 24 hours

This is not a good idea, because it’s a very easy denial of service against an account. Lockouts should never be on an account, but on an IP address.