Login implementation security concerns
Not a comprehensive review, but I'll list a few things which came to my notice right away:


Define the login_limit variable as login_limit_count to keep it consistent with login_limit_window.
Instead of defining the above 2 as class attributes, define them as constants in config/constants.php file.
Use === in the condition: ($this-&gt;form_validation-&gt;run() == FALSE)
The login method inside your user_model doesn't actually log-in the user. It just fetches the user details based off of $username. No need to provide it with $password and rename it to get_user or similar. Alternatively, put the password_verify inside the model, and return a user on successful login.
A select * is very bad. You should always know what values you'd be using from the result.
Hardcoding $route_url inside each controller method, and then calling check_request_route can be avoided using $_SERVER['REQUEST_URI'] variable and defining a hook. The hooks need to be enabled first in config/config.php. This way, you can track visits to multiple pages from a single location.