Timeline for Possible improvements on admin login area?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 26, 2013 at 23:35 | vote | accept | tricon | ||
| Dec 26, 2013 at 23:35 | comment | added | tricon | Thanks a lot for the explanation and the code Royal. This is a great help. I am going to translate your example into my pages tomorrow. | |
| Dec 26, 2013 at 21:58 | comment | added | Royal Bg | session_id() is enough. You can insert everytime an user tries to login the session_id. Once there are 5 failed logins with th e same session_id - ban the user. You can change session_id() with IP for example. I added some code | |
| Dec 26, 2013 at 21:57 | history | edited | Royal Bg | CC BY-SA 3.0 |
added 3470 characters in body
|
| Dec 26, 2013 at 21:28 | comment | added | tricon | Do you maybe have a source for me, where I can check up and learn this technique? I get the basic Idea, I am just not that proficient with handling sessions (and as you mentioned "attempts for one certain session") yet. Thank you again. | |
| Dec 26, 2013 at 21:13 | comment | added | Royal Bg | You can use database. Log the attempts there. If for certain session there are more than X attempts - add in a blacklist table and ban for Y hours. | |
| Dec 26, 2013 at 21:10 | comment | added | tricon | Thanks for the great suggestion Royal Bg. May I ask, what sort of limitation for login attempts you suggest? Would a (clear) captcha login be enough to make sure that no bots hammer the login form, or do you recommend something else? Thanks again. | |
| Dec 26, 2013 at 20:12 | review | First posts | |||
| Dec 26, 2013 at 20:16 | |||||
| Dec 26, 2013 at 19:55 | history | answered | Royal Bg | CC BY-SA 3.0 |