I don't particularly want to implement Captcha on my login form for a website. But I've got a block mechanism already in place.

What's the best way to protect from Brute Force attacks?

Here's what I was thinking:

  1. Implement a lockout, so after 30 failed logins I block the customer account. 30 is an arbitrary number, but I figure brute force attack isn't going to guess within 30, and any customer who tries 30 times is probably going to have to call in for a password reset anyway.

  2. Or should I just ignore brute force, and maybe implement it at a firewall, is there a firewall that can detect and stop brute force attacks?

I would think option 2 is better because the brute force won't drain my server resources if the requests don't reach it.

  • 2
    Why no CAPTCHA? You could show it after N failed attempts. Proof of Work is another option. Commented Jul 24, 2015 at 6:43

4 Answers 4


As others have mentioned already, currently the recommended way of implementing lockout is to require a Captcha only after a few failed login attempts. This method is good from both a security and usability standpoint - the Captcha is very effective on stopping automated attacks, but only requiring it after a few failed logins makes it so that legitimate users will rarely even see it. (Another benefit is that no real person is ever "truly" locked out; they can keep trying as long as they can keep answering the Captcha correctly, which takes enough time and effort that it's not usually considered a significant security risk.)

If you really want to avoid Captcha entirely, both methods you present would work if properly implemented but neither is ideal usability-wise. If you use Option 1, someone could intentionally lock out other usernames, either just to cause trouble or to exact "revenge" against another user. If it's a small site it might not be a big deal, but if the site is large enough it's pretty much guaranteed to happen at some point.

Option 2 is a bit better, but you have to consider shared IP addresses. Many schools and businesses have hundreds or thousands of computers behind a single public IP address, so if that IP is banned many legitimate users could be affected.

  • ok I guess consensus seems to be that I should implement captcha after n times. I'll do that, but I might take a look at this app called Snort that came up in a google search.
    – Richard G
    Commented Jul 25, 2015 at 0:42

How are you planning on implementing the lockout? Is is per username or network address. If you consider the first option bear in mind that the attacker can launch a denial of service attack for any number of valid users(he can simply brute force a number of (very likely) invalid passwords for each valid username and thus lock out the respective user).

Blocking attempts at the network can be overcome if the attacker launches a synchronized brute force attack from (enough) multiple workstations, each with a different network address.

What is wrong with using a captcha? It's much easier to implement and will avoid a lot of future headaches.


You're correct, the only way to protect against bruteforce attacks is a lockout. This is always implemented when the password space is very small e.g. for 4-digit PINs in bank cards or phone SIMs.

Be careful as option #1 (disallow login after n failed login attempts) can be used as a DoS to lock out a customer. If you want to do this, you should put a CAPTCHA into place that kicks in after m failed logins, with m<n.

Option #2 (blacklist the IP address after n failed login attempts) is much better. How to implement it depend on the server OS; on Linux you have fail2ban.


Not sure if you were able to address this issue or not, but our product offers both. We have a device that filters your traffic.

Instead of you having to insert a CAPTCHA challenge each time an instance of your login page is requested, we perform analysis of the requester to determine if they are a bot. We do this with a 200 point fingerprint and a series of browser challenges. If we are certain it's a bot, we perform one of several actions (depending on your preference): block, CAPTCHA, serve alternate content, or just monitor.

The benefits are: 1. Judicious use of CAPTCHA while preventing automated brute force attempts 2. A buffer that scrubs traffic between the internet and your origin -- which drops the load on your site.

Anyway, the company is called Distil Networks, we have hundreds of customers and help protect billions of dollars in revenue. Here's where you can find us if you want to learn more: http://resources.distilnetworks.com/h/

Here's a piece we did with a few customers having similar problems: http://resources.distilnetworks.com/h/i/246536302-optimizing-web-application-security-to-fight-bad-bots/185088

Let me know if you have any questions. [email protected]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .