Unlimited login attempts are a brute force welcome mat. Throttle or lock after 5–10 failures. Add exponential backoff and alert on suspicious patterns.