The site should have the capability to detect login attempt for multiple attempts - Show captcha Same account login attempt from multiple IPs - show captcha With the above: a simple time wait for next attempt could solve the issue for most legit attempts right?