So most of the time well done brute force attacks involve a program written to keep guessing many passwords every second. On my login forms and what not I use a form key which changes every time the page loads. The key has to match on the script or they won't be logged in etc. This ensures that someone indeed DID visit the page and a machine isn't just guessing over and over again.
I'm talking about using something like this
That said I'm assuming using just that wouldn't be foolproof since a hacker can keep the form keys in session, but I would assume this would slow things way down right?
