# Security measures proposal - User login brute force prevention, and more

**URL:** <https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023>\
**Category:** Feature\
**Created:** [2014 年8 月 19 日 00:42 UTC](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023 "2014-08-19T00:42:23Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

作者： ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)\
发布日期： [2014 年9 月 8 日 18:15 UTC](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023/5 "2014-09-08T18:15:00Z")

</div>

It looks like we already have rate limits on password reset. Current behaviour:

- Up to 1 reset per minute
- Up to 6 requests per hour

I think that is sufficient for now.

---

_[View the full topic](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023)._