|
You would need to track the users' IP and their session ID - although, both are easily duped.
Locking a user out after 3 attempts is practical, but it will not stop an experienced user.
Locking out a Username is a good practice, but how would you allow the REAL user access if simultaneously his account is being locked out by a spammer?
|