This feature monitors failed login attempts and allows you to take automated action in response.
Enables monitoring of failed login attempts. When active, each failed login is recorded and can trigger further actions based on the options below.
Specifies which login forms are monitored. You can choose to monitor frontend logins only, backend (administrator) logins only, or both. Monitoring backend logins is especially important for detecting brute-force attacks against administrator accounts.
When enabled, each failed login attempt creates a log entry in the Web Firewall logs. If email notifications are configured under the Email notifications section, an alert email is also sent to the administrator.
When enabled, the password used in the failed login attempt is included in the log entry. This can be useful for security audits. Note that the password is stored only in the log and is never sent by email.
The action to take when a failed login attempt is detected. Available actions typically include adding the offending IP address to the dynamic blacklist after a configurable number of failed attempts, which provides automatic brute-force mitigation.