"Brute force login attacks are common, and there are three measures you can use to defend against them. The first is account lockout. Any account attempting this type of access can be locked until the administrator decides if it has been compromised or not. The second defense is called progressive delay. This involves locking the account for a set period of time after several unsuccessful login attempts. Finally, there is the challenge-response test, where users are asked to verify a predetermined security question they set up when registering for their account. I would recommend either one or a combination of these which best meet the client's business model."