Response delay tactic depletes PHP processes

Hi,

After running this plugin, I found that the response delay upon failed login attempts is fine against small attacks but if there is a full blown brute-force attack going on, the web server runs out of available PHP processes very quickly. It starts responding with “Bad Gateway” or “Service Unavailable” messages depending on server setup.

I am guessing in a large scale attack all processes are hogged for about 25 to 60 seconds (at least with the default plugin settings) by the delayed response. As soon as the max number of PHP processes has been reached, ALL subsequent requests get denied. And this included normal page requests!

So effectively, this plugin turns a brute-force attack into a denial of service attack 😉

Kidding aside, I’d like to propose that the second tier uses a different method: return a simple 503 or 403 response instead of an increased response delay.

In the mean time I’m forced to switch back to Limit Login Attempts because I cannot afford a plugin bringing my sites down, even as a measure of protection 🙁

https://ww.wp.xz.cn/plugins/login-security-solution/