Rate Limit the Login Page Before Anything Else
I remember being woken up at 3:00 AM by a server alert that sounded like a death knell. It wasn’t a hardware failure or a massive DDoS; it was just a script, mindless and relentless, trying every possible password combination …