5 failed attempts → 15 min IP-lockout