One of Drupal's strengths is its ability to create communities of users who contribute towards the content of the site. Whether you have an open forum, where users can create their own accounts, or a closed magazine site with just a few editors, you need to take the security of your users seriously.
Out of the box, Drupal has a number of account protection features that assist in making sure that users are authenticated correctly.
For example, the user login page is protected by a brute force system and will lock accounts after a number of incorrect password attempts in a short amount of time.
Read more here: https://www.hashbangcode.com/article/drupal-10-adding-extra-user-account-protection