LoginTimer by Ryan Cramer

Normalize successful and failed login times to prevent timing attacks.

Login Timer for ProcessWire

Prevents timing attacks by enabling normalization of login times so that a failed login is no faster than a successful login.

This prevents timing attacks from discovering any information about good vs. bad user names or passwords based on the time taken to process the login request. It does this by remembering how long successful logins take and applying that same amount of time to failed logins.

Please see the post with Details and documentation for this module.

Installation

  1. Copy all files from this module to /site/modules/LoginTimer/
  2. Go to Modules > Refresh in your admin.
  3. Install the Site > Login > Login Timer module.
  4. Logout and log back in.

The last step above will prime the login timer so that it can establish an appropriate login time for your system. This time is recalculated up to 24 times per day.

Once installed, this module will automatically apply to all logins from ProcessWire’s $session API variable. For instance, logins from the ProcessWire login form, and the LoginRegisterPro module are covered by this module.

Install and use modules at your own risk. Always have a site and database backup before installing new modules.

Latest news

  • ProcessWire Weekly #568
    The 568th issue of ProcessWire Weekly brings in all the latest news from the ProcessWire community. Modules, sites, and more. Read on!
    Weekly.pw / 30 March 2025
  • ProcessWire 3.0.244 new main/master version
    ProcessWire 3.0.244 is our newest main/master/stable version. It's been more than a year in the making and is packed with tons of new features, issue fixes, optimizations and more. This post covers all the details.
    Blog / 18 January 2025
  • Subscribe to weekly ProcessWire news

“We chose ProcessWire because of its excellent architecture, modular extensibility and the internal API. The CMS offers the necessary flexibility and performance for such a complex website like superbude.de. ProcessWire offers options that are only available for larger systems, such as Drupal, and allows a much slimmer development process.” —xport communication GmbH