John works as a professional Ethical Hacker. He has been assigned a project to test the security server. Now, he suggests some countermeasures to avoid such brute force attacks on the We- are-secure s

Restricting login attempts to three tries directly prevents brute force by locking out or throttling access after a small number of failures, making automated credential guessing infeasible. This is one of the most direct and effective controls against online brute force attacks.

Increasing encryption key length strengthens cryptographic operations but does not prevent an attacker from submitting unlimited login guesses against a web form, so it does not mitigate online brute force attacks.

CAPTCHA challenges after repeated failures block automated tools from continuing to submit credentials, since bots cannot reliably solve human verification puzzles. This allows legitimate users to continue while disrupting scripted attack tools.

Periodic password changes reduce the window of exposure if a credential is already compromised, but they do not prevent or interrupt an ongoing brute force attempt against the login interface.