# Security measures proposal - User login brute force prevention, and more

**URL:** <https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023>\
**Category:** Feature\
**Created:** [2014 年8 月 19 日 00:42 UTC](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023 "2014-08-19T00:42:23Z")\
**Posts on this page:** 1\
**Showing post:** 10

<div class="post-metadata">

作者： ![michaeld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaeld/32/1594_2.png) [@michaeld](https://meta.discourse.org/u/michaeld)\
发布日期： [2014 年9 月 8 日 20:44 UTC](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023/10 "2014-09-08T20:44:39Z")

</div>

> [@Lid](#):
>
> After 10 failed attempts, transparently deactivate logins for this account for 24 hours

This is not a good idea, because it’s a very easy denial of service against an account. Lockouts should never be on an account, but on an IP address.

---

_[View the full topic](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023)._