Skip to main content
ALTCHA®

Login & Auth Protection

Login endpoints are a prime target for credential stuffing and brute-force attacks — and unlike a contact form, a compromised login has a direct payoff for an attacker, so it's worth protecting more tightly than a general-purpose form.

What you're defending against

  • Brute-force / credential stuffing — scripted, high-volume login attempts, often testing leaked credential lists against your login endpoint.
  • Account takeover — a successful login from a location, device, or network that doesn't match the account's normal pattern.
  • Compromise via impossible travel — a session that logs in from two distant locations within a timeframe that isn't realistically possible, which usually means a stolen credential or session is in play.
  1. Enable Adaptive Captcha on the login form's Security Group — it detects suspicious login attempts and escalates automated ones to a Code Challenge, without adding friction for normal logins.
  2. Add a Rate Limiter on the login endpoint, scoped per IP (and per account/username if your login flow can key on it), to cap how many attempts are allowed in a given window — this is what actually stops a brute-force run.
  3. Enable an IP Resolver and Threat Intelligence so known proxies, Tor exit nodes, and IPs already flagged by threat feeds get scrutinized before they reach your login logic.
  4. Use Classifier's fast-traveler detection to catch impossible-travel logins: pass the login request's ip and timeZone, along with lastKnownLocation from the account's last successful login, and Classifier's LOCATION_DISTANCE / TIMEZONE_MISMATCH rules will flag logins that don't add up.
  5. Keep Autopilot on so difficulty adapts automatically if you see a credential-stuffing spike.

Integration steps

  1. Add the ALTCHA widget to your login (and registration) form.
  2. Make sure Adaptive Captcha is enabled on that form's Security Group.
  3. In your login handler, after verifying the ALTCHA payload (see Server Integration), call the Classifier API with the request's IP and timezone to get a risk signal before completing the login — and store the location for next time, so fast-traveler detection has something to compare against.

Start typing to search...

↑ ↓ Navigate ↵ Select