- Issue created by @mahmoudsayed96
- 🇻🇳Vietnam doidd
Not limiting the number of login attempts for admin accounts creates a significant security vulnerability that can easily be exploited by attackers. This approach increases the risk of brute force attacks, as attackers can try endless combinations without facing any restrictions.
A better solution is to use an IP whitelist feature. - 🇳🇱Netherlands batigolix Utrecht
The actual logic that blocks or excludes an account or ip address is done by Drupal Core.
The contrib module Flood Control provides a UI for Core settings and for Unblocking accounts or IPs.
Feel free to move this issue to the Drupal Core queue.
- Status changed to Closed: works as designed
10 days ago 7:01am 28 February 2025