Defend against automated login

Attackers reuse leaked credentials and automate guesses. Password correctness alone is not an adequate abuse boundary.

Rate-limit by account and network signals, add progressive delays, log suspicious patterns, and notify users of meaningful risk. Block known-compromised passwords during creation or change without sending the full password to a third party. Avoid simple permanent lockouts an attacker can trigger.

Different attacks leave different evidence:

• Brute force: many passwords against one account.
• Password spraying: one password against many accounts.
• Credential stuffing: leaked email/password pairs tried at scale.

One IP limit misses distributed attacks and can punish a school or office behind shared NAT. One account limit lets an attacker lock out a victim. Combine short-window network, account, device, and global signals with progressive responses.

Start with small delays and monitoring. Escalate to temporary challenges or step-up authentication when risk rises. Keep a clear recovery path for the real user and avoid telling the attacker whether an account exists.

Record reason codes, rate-limit decisions, and coarse network information with a retention policy. Alert on changes in success rate, distributed failures, and attempts against high-value accounts. Never log submitted passwords.

Test controls with concurrent requests. A counter updated only in process memory can reset across instances or deployments and fail exactly when traffic spreads out.

Design thresholds and responses for one failed login, repeated failures for one account, and distributed attempts across many accounts. Explain the denial-of-service tradeoff of every limit.