Login attempts are rate-limited and logged. After 5 failed attempts the account locks for 30 minutes.