Username Trap

How it works

This is another simple, yet effective protection against login attempts by bots using predefined usernames for brute force login attempts. If the login fails, this feature checks username against the list of trap usernames, and if the username is on the list, the attempt will be logged with the username trap event, and if same IP breaks this rule multiple time, that IP will be banned.

What are trap usernames?

Username Trap feature uses ‘Trap Username’ and ‘Deny Username’ lists from Dictionary to trap failed logins. It is important to know, that these lists should contain only usernames that are not already registered on your website! There are two different lists, to allow for one list to be only used for this feature, and the other ‘Deny Username’ list is used for the Registation Control feature too.

Deny Username list already contains some common usernames that websites should avoid having (admin, administrator, webmaster, username, password, root…), and you can add more.

Settings

This feature has only one option:

• Use Deny List: by default, this feature will only use ‘Trap Username’ list, with this option it will use ‘Deny Username’ list too.