Login attempts limit

Question

We've just had a security review of a client's site and one main issue raised is that a brute force attack would reveal the password if the username was guessable (ie "admin").

Could a limit on the number of login attempts be a possible feature in the future? Failing that does are there any suggestions for how we could best protect against this sort of intrusion with the current version of Craft?

Thanks!

Answer 1

There are several config settings which should help...

• maxInvalidLogins - The number of invalid login attempts Craft will allow within the specified duration before the account gets locked.
• invalidLoginWindowDuration - The amount of time to track invalid login attempts for a user, for determining if Craft should lock an account.
• cooldownDuration - The amount of time a user must wait before re-attempting to log in after their account is locked due to too many failed login attempts.

In addition, you may also want to change your cpTrigger from the default.

Lastly, there is a feature request to strengthen password requirements, where Brandon Kelly posted a link on how to enforce your own stricter password requirements.