Adding Account Lockout Protection

Account lockout delays repeated guesses, ideally by user/account and source risk factors.

What It Does

Account lockout delays repeated guesses, ideally by user/account and source risk factors. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

PHP 8.x and a local test environment. Apply input validation, correct error handling and the requirements of any optional libraries.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Understand the primary operation and its inputs.

<?php
$attempts = ['count' => 4, 'window_start' => time() - 20];
$allowed = $attempts['count'] < 5;
var_dump($allowed);

Example 2: Another Case

Check failure behavior or a different execution path.

<?php
$attempts = ['failures' => 6, 'locked_until' => time() + 60];
if ($attempts['locked_until'] > time()) echo 'Temporarily delayed';

Practical Example: Putting It to Use

Distinguish account lockout from an IP-only global API throttle.

<?php
$now = time(); $state = ['failed' => 6, 'lock_until' => $now + 90];
$locked = $state['failed'] >= 5 && $state['lock_until'] > $now;
var_dump($locked);

Important Behavior and Edge Cases

Avoid permanent easy-to-trigger lockouts that enable denial-of-service against victims.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• Account lockout delays repeated guesses, ideally by user/account and source risk factors.
• Avoid permanent easy-to-trigger lockouts that enable denial-of-service against victims.
• Combine measured retry limits with MFA and careful recovery design.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.