This question already has an answer here:

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:-

  1. Locking a person for 15 minutes if they fail to login correctly three times in succession over a five minute period.
  2. Locking them out totally and making them reset their password if they fail to login correctly, say, a dozen times in succession in any one 24 hour period.

It has been suggested to me that these settings are a bit harsh! Are there any guidelines on this? Information on the subject seems (from my Googles) somewhat limited.

Thank you...

marked as duplicate by M'vy, SilverlightFox, Jens Erat, Mark, RoraΖ Mar 3 '15 at 12:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


There is no right or wrong answer. If you implement a more aggressive lockout policy then you will be more secure and you will degrade your user experience.

You have to assess where the right balance is for yourself, based on your application's requirements, your knowledge of your user base, the value of the assets you are protecting, your threat model, your risk analysis results, etc. etc.

  • The eternal balance between 'usability' and 'security'. – schroeder Mar 2 '15 at 18:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.