A web vulnerability scanner on my website made a suggestion that I implement an account lockout mechanism for my site when there has been a certain number of invalid login attempts. I am trying to wrap my head around this to make sure I do it correctly.

This is what I have decided to do. First, in the event of an invalid login attempt the initial error message is that either the username or password was incorrect.

Next, if the username was correct for successive attempts, but the password incorrect, I will begin a counter that will lock the account after x number of tries. I won't display the counter right away, maybe not until there are two tries remaining. This way a user won't get nervous if they simply made a spelling error on their first attempt.

If a user does proceed to lock the account, it can be unlocked by further entering the correct credentials plus answering a security question. If they still do not know the password, they can initiate password recovery through email.

My problem arises when deciding what to do when there have been successive invalid attempts where the username is incorrect. Since the username is incorrect, there is no account to lock. I have read suggestions to lock the login script internally and introduce a throttle to slow down any would be crackers, but just continue to display the standard error message that the username or password is incorrect. The only problem I have with this suggestion is that once somebody figures out how the lockout works they can gain a clue as to whether they are inputting a valid username or not, by seeing a counter after successive failures they will know they have a valid username, no counter = not a valid username.

Anybody have thoughts on this they can share?

EDIT I agree that some legitimate users could get caught in this lock out process. I think that my use of the phrase "would be crackers" takes into account that not everybody who forgets their username/password is indeed a cracker.

  • 2
    Why do you assume that anyone doing multiple login attempts is a cracker? Plenty of people cannot remember what username they registered with and using an ambiguous "username or password is wrong" message does little to help these people. Many cannot even remember what email address they signed up with for account recovery purposes. Related reading: blog.mailchimp.com/social-login-buttons-arent-worth-it
    – cimmanon
    Commented Oct 9, 2013 at 17:17
  • The assumption that I am making for my site, and it could be wrong, is that I will not get casual users who may sign up and then forget they did. The particular people that I am targeting, lawyers with a little bit of tech knowledge, should be able to remember their username and password. I suppose data will prove this assumption correct or not, but my bias to begin with is if I see a bunch of invalid logins on this site something may be up. Again, I could be wrong. I guess if you take the position that it is not a big deal to tell whether a username is correct, my issue kind've dissappears.
    – Cbomb
    Commented Oct 9, 2013 at 18:15
  • 1
    I'm a developer myself and even I can't remember the username/password/email combination I use for every site. I have 2 usernames, 6 passwords, and 3 email addresses that I commonly use for account purposes. Even if I guess the right combination on the first try, there are other factors that may cause authentication errors (caps key on, fat fingers, etc.).
    – cimmanon
    Commented Oct 9, 2013 at 18:23
  • I use a password manager myself. When I saw a list of all my passwords, about 50 in all, I was flabbergasted as to how many there were.
    – Cbomb
    Commented Oct 9, 2013 at 18:30

1 Answer 1



"to lock the login script internally and introduce a throttle to slow down" is far more mature approach to handle erroneous login attempt.

As far as i know Windows as well as Linux use this approach. Don't know about Mac, though.

You can make that a little more interactive by adding that after 2/3 wrong attempt, the "Forgot Password" button shows up.

  • 1
    I agree with the slower and slower response for failed attempts from the same client (IP), but that can lead to issues for people sharing a proxy. Introducing Captcha after a few failures could alleviate that. Commented Oct 10, 2013 at 9:25
  • @BernhardHofmann i agree with you that using captcha can alleviate that. But, it is justified depending on the diversity of the website itself.
    – kmonsoor
    Commented Oct 10, 2013 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.