PHP Login Rate Limiter (Session Based)
A slightly more production-shaped login limiter that blocks repeated attempts over a lock window, returns consistent responses and gives you a cleaner place to evolve later into database or IP-backed rate limiting.
Stack / dependencies
Compatibility
Usage notes
Put this near the top of your login handler, before checking user credentials against the database.
Why this exists
Brute-force protection is often skipped early, but it is one of the easiest wins for basic account hardening.
Integration steps
- 1 Start the session before running any rate-limit checks.
- 2 Run the lock check before querying the database.
- 3 Increment the failure count after a failed login attempt.
- 4 Reset counters immediately on successful login.
- 5 Later, move the store to MySQL or Redis if you need per-IP or cross-device controls.
Code snippet
Full version with formatting intact. Use “Copy stripped version” when you want a leaner base.
Implementation notes
Security notes
- Do not reveal whether the username exists.
- Use password_hash() and password_verify() for credentials downstream.
- Pair this with secure session cookies and CSRF protection on the form.
Tags
Related snippets
View allSecure PHP Contact Form Handler
A more real-world contact form endpoint for bespoke PHP builds. Includes request method enforcement, CSRF validation, anti-bot checks, sane input validation, response helpers and a clean place to wire PHPMailer or your preferred provider.
PDO Bootstrap (db.php pattern)
A stronger db bootstrap for bespoke PHP apps. Uses static reuse, utf8mb4, disabled emulated prepares, clear exception handling and small helper structure that fits shared hosting as well as more advanced setups.
Apache Security Headers Snippet
A more practical security header baseline for bespoke sites. Includes strict transport guidance, clickjacking protection, content sniffing protection and a commented CSP starter you can tune later.