[Dixiemill]

I've had to take our board offline because:
1) our URL was leaked (probably via referrers)
2) someone's username is a dupe of a username used at another board
3) a password cracker program was run against the account.

I'm desperate, this is the 4th time we've been hacked into by script kiddies using password crackers. Once they get in they can then see account names for all our users, then can continue to use the script to hack those accounts.

What I'd like to do is limit the number of invalid password attempts, then if the user has invalidly attempted 3 times, the account gets demoted to a usergroup that has no access to the site, so even if they do sucessfully crack the password, they can't even see anything.

Thanks in advance for your assistance.