title: Prevent brute force with php
body: <p>I have a php script and would like to add protection against brute force, can anyone help? I don't want a captcha, but something in which the client is prevented from making further attempts for a certain time after several failed login attempts. And if possible without a database.</p>
  <p>Another question by the way, how can you keep a log of all log in (attempts) and from which ip address they come from?</p>
  <pre><code>&lt;?php
  
  $LOGIN_INFORMATION = array(
    'Admin' =&gt; 'Password',
  );
  
  define('USE_USERNAME', true);
  
  define('LOGOUT_URL', 'https://example.com');
  
  define('TIMEOUT_MINUTES', 1);
  
  define('TIMEOUT_CHECK_ACTIVITY', true);
  
  if(isset($_GET['help'])) {
    die('Include following code into every page you would like to protect, at the very beginning (first line):&lt;br&gt;&amp;lt;?php include(&quot;' . str_replace('\\','\\\\',__FILE__) . '&quot;); ?&amp;gt;');
  }
  
  $timeout = (TIMEOUT_MINUTES == 0 ? 0 : time() + TIMEOUT_MINUTES * 60);
  
  if(isset($_GET['logout'])) {
    setcookie(&quot;verify&quot;, '', $timeout, '/'); // clear password;
    header('Location: ' . LOGOUT_URL);
    exit();
  }
  
  if(!function_exists('showLoginPasswordProtect')) {
  
  function showLoginPasswordProtect($error_msg) {
  ?&gt;
  
  &lt;!-- ↓ Log in form ↓ --&gt;
  
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;head&gt;
      &lt;meta charset=&quot;utf-8&quot;/&gt;
      &lt;meta http-equiv=&quot;content-type&quot; content=&quot;text/html; charset=utf-8&quot; /&gt;
  &lt;/head&gt;
  
  &lt;body&gt;
      &lt;p id=&quot;errormsg&quot;&gt;&lt;?php echo $error_msg; ?&gt;&lt;/p&gt;
      &lt;input type=&quot;hidden&quot; id=&quot;harvestID&quot; value=&quot;none&quot; /&gt;
      &lt;input type=&quot;hidden&quot; id=&quot;expiryID&quot; value=&quot;none&quot; /&gt;
      &lt;input type=&quot;hidden&quot; id=&quot;authenticationID&quot; value=&quot;true&quot; /&gt;
      &lt;form id=&quot;command&quot; name=&quot;form2&quot; action=&quot;/&quot; method=&quot;post&quot;&gt;
          &lt;input id=&quot;iForgotNewWindowVar&quot; name=&quot;openiForgotInNewWindow&quot; type=&quot;hidden&quot; value=&quot;false&quot; value=&quot;false&quot;/&gt;
          &lt;input id=&quot;fdcBrowserData&quot; name=&quot;fdcBrowserData&quot; type=&quot;hidden&quot; value=&quot;&quot;/&gt;
          &lt;div class=&quot;pair&quot;&gt;
              &lt;div class=&quot;module&quot;&gt;
                  &lt;label for=&quot;accountname&quot;&gt;Name&lt;/label&gt;
                  &lt;input id=&quot;access_login&quot; name=&quot;access_login&quot; autocorrect=&quot;off&quot; spellcheck=&quot;false&quot; type=&quot;text&quot; autocapitalize=&quot;off&quot; aria-label=&quot;Name&quot; value=&quot;&quot; size=&quot;30&quot; maxlength=&quot;128&quot; autocomplete=&quot;off&quot;/&gt;
              &lt;/div&gt;
              &lt;div class=&quot;module&quot;&gt;
                  &lt;input id=&quot;access_password&quot; name=&quot;access_password&quot; autocorrect=&quot;off&quot; oncopy=&quot;return false;&quot; oncut=&quot;return false;&quot; autocapitalize=&quot;off&quot; type=&quot;password&quot; value=&quot;&quot; size=&quot;30&quot; autocomplete=&quot;off&quot;/&gt;
              &lt;/div&gt;
          &lt;/div&gt;
      &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  
  &lt;?php
    // stop at this point
    die();
  }
  }
  
  if (isset($_POST['access_password'])) {
  
    $login = isset($_POST['access_login']) ? $_POST['access_login'] : '';
    $pass = $_POST['access_password'];
    if (!USE_USERNAME &amp;&amp; !in_array($pass, $LOGIN_INFORMATION)
    || (USE_USERNAME &amp;&amp; ( !array_key_exists($login, $LOGIN_INFORMATION) || $LOGIN_INFORMATION[$login] != $pass ) )
    ) {
      showLoginPasswordProtect(&quot;Failed to log in, try again&quot;);
    }
    else {
      setcookie(&quot;verify&quot;, md5($login.'%'.$pass), $timeout, '/');
      
      unset($_POST['access_login']);
      unset($_POST['access_password']);
      unset($_POST['Submit']);
    }
  
  }
  
  else {
  
    if (!isset($_COOKIE['verify'])) {
      showLoginPasswordProtect(&quot;&quot;);
    }
  
    $found = false;
    foreach($LOGIN_INFORMATION as $key=&gt;$val) {
      $lp = (USE_USERNAME ? $key : '') .'%'.$val;
      if ($_COOKIE['verify'] == md5($lp)) {
        $found = true;
        if (TIMEOUT_CHECK_ACTIVITY) {
          setcookie(&quot;verify&quot;, md5($lp), $timeout, '/');
        }
        break;
      }
    }
    if (!$found) {
      showLoginPasswordProtect(&quot;&quot;);
    }
  
  }
  
  ?&gt;
  
  CONTENT HERE WILL BE DISPLAYED AFTER LOGIN
  </code></pre>