Automatically blocks IPs after repeated failed attempts. Server-side enforcement with a live countdown — bots can't bypass it by disabling JavaScript.
Your password-protected page fires a verify request to ACKgeo's server.
Failed attempt is recorded server-side against the visitor's IP. No client-side state.
IP is blocked for 15 minutes. The login form disables with a live countdown timer.
Lockout clears automatically. Legitimate users who got locked out can try again after the timer.
Lockout is enforced on ACKgeo's server, not in the browser. Disabling JavaScript doesn't bypass it.
Locked-out visitors see a real-time countdown. The form re-enables automatically when it expires.
Lockouts are per IP per site. One locked-out user doesn't affect anyone else accessing the same page.
Any IP firing more than 30 requests in 10 seconds is automatically blocked at the geo layer — before rules even run.
Every lockout event appears in your traffic log as a rate_limited entry with IP, location and ASN. Pro+ only.
Free, Pro and Business all get brute force protection. No upgrade needed — it's built into every ACKgeo account.
No extra cost, no setup required. Brute force protection activates automatically when you enable password protection.
Create free account