hi folks, I have a question.
I found most sites will increase the block time exponentially for each failed login attempt. If the attempts are done by malicious users then the legitimate user will also need to wait until the block is released.
How can we as the site owner solve this issue? I meant we want to only block the malicious users but not the legitimate one. Any idea is welcome. Thank you!