A recent comment on blogcfc.com encouraged me to modify the code that protects my application against brute force attacks. The following article recommends escalating the failed login delay based on the number of failed attempts. While this will not bother legitimate users, it will definitely annoy and possibly prevent the potential hacker (then again, do you really want to annoy hackers?)

The following code snippet implements the delay in ColdFusion.