Brute-force attacks try many password combinations (or many leaked username/password pairs, in the credential-stuffing variant) against a login form until one works.
Layered defenses
- Rate limit login attempts per IP and per account
- Lock or delay an account temporarily after several consecutive failures
- Require multi-factor authentication — this alone defeats most successful brute-force attempts even if a password is eventually guessed or leaked
- Use CAPTCHA after a threshold of failed attempts, not on every single login
- Monitor and alert on unusual login patterns (many failures across many accounts from one source)
FAQ
Is a strong password policy alone enough?
No — it raises the bar for pure brute-force guessing, but does nothing against credential stuffing using already-known, leaked passwords; the layered defenses above address both.