Have lockout after 5 failed attempts. Have user type capta data to unlock or use a specified time limit for relogin. Even the Go-To page requires the user to enter the picture code before posting this message. This would slow down code breaking software and better protect the user's passwords.....