We've just had a security review of a client's site and one main issue raised is that a brute force attack would reveal the password if the username was guessable (ie "admin").

Could a limit on the number of login attempts be a possible feature in the future? Failing that does are there any suggestions for how we could best protect against this sort of intrusion with the current version of Craft?


1 Answer 1


There are several config settings which should help...

  • maxInvalidLogins - The number of invalid login attempts Craft will allow within the specified duration before the account gets locked.
  • invalidLoginWindowDuration - The amount of time to track invalid login attempts for a user, for determining if Craft should lock an account.
  • cooldownDuration - The amount of time a user must wait before re-attempting to log in after their account is locked due to too many failed login attempts.

In addition, you may also want to change your cpTrigger from the default.

Lastly, there is a feature request to strengthen password requirements, where Brandon Kelly posted a link on how to enforce your own stricter password requirements.

  • Perfect! Thanks so much Lindsey! (I probably should've RTFD first :)
    – user3585
    Commented Jan 6, 2016 at 23:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.