Throttle logins by account and by address, separately
One attacker with many addresses and many attackers on one address are different attacks. A single counter catches only one of them.
Tagged “login”
2 entries
2 entries
One attacker with many addresses and many attackers on one address are different attacks. A single counter catches only one of them.
No Redis, no extension, no cron. One table and one function that caps any action per key within any window, and fails open so an outage never locks the site.