Hi, Jake. I think it's because Gluu itself is rarely being used as authenticator, most of the times it relies on some backend for that, which is already should have such protection as usually it belongs to pre-existing infrastracture (for example, AD's LDAP Provider has this feature) But if you really need to use Gluu's internal LDAP directory for authentication, you can enable account lockout in OpenDJ: [http://opendj.forgerock.org/doc/admin-guide/index/chap-account-lockout.html](http://opendj.forgerock.org/doc/admin-guide/index/chap-account-lockout.html) Regards, Alex.

Hi, Jake. oxAuth allows to write user authentication plugins. This helps to implement any authentication scenario to conform requirements without application update.

Yuriy is quite correct. You can use a number of different fraud detection strategies by writing a custom authentication script. I am closing this issue.