Anti-Bruteforce measures

[thelicato]

Hello, I've been using umami for a couple days now. I found out that it does not seem to have any prevention mechanism against bruteforce attacks. You could add maybe a lockout for a specific account or IP address even though they can easily become ineffective. For this reason I think the best solution is to add also 2-Factor-Authentication.

Let me know what you think and if you plan to introduce it.

[mikecao]

Preventing brute-force is usually done at the server level. I am looking into adding email features in the next release so maybe 2FA can be a part of that.

[thelicato]

I think that 2FA would be a huge improvement for security in Umami. Thanks for your work.
You should enable the sponsoring on this project, keep going!