How do you protect login endpoints from brute force and credential stuffing?

Summary

Rate-limit by IP, account and device fingerprint; add progressive delays or temporary lockouts; use bot detection/CAPTCHA after failures; check passwords against breached lists; require MFA; and monitor for distributed attacks (many IPs, many accounts).

Longer Answer

Be careful that lockouts don't enable denial-of-service against specific users; prefer throttling and step-up challenges. Return generic error messages ('invalid email or password') to avoid user enumeration, and keep response timing consistent.

Key Points

• Multi-dimensional rate limits
• Progressive delays, step-up challenges
• Breached-password checks + MFA
• No user enumeration