This login security checklist walks through the practical checks worth making on any website or app: passwords, login attempts, multi-factor authentication, sessions, and password resets. None of it requires deep technical expertise, mostly it comes down to configuration choices that are easy to get right and just as easy to forget. Whether you’re auditing your own project or learning what to look for, work through each section below and tick off what’s already covered. Anything you’re unsure about links to a fuller explanation.
What This Login Security Checklist Covers
This checklist draws on the same principles laid out in the OWASP Authentication Cheat Sheet, a widely referenced industry resource, condensed here into five practical categories you can work through directly: passwords, login attempts, multi-factor authentication, sessions, and password resets.
📌 How to use this: Go category by category. Each checkbox is clickable, so you can check items off as you review them. Use the print button below to save or print a clean copy.
🖨️ Print This Checklist
🔑 Passwords
Passwords remain the most common attacker target, mostly because storage and length requirements are still often done wrong.
- Passwords are hashed with bcrypt, scrypt, or Argon2, never stored in plain text or MD5/SHA1. See our guide on dangerous password practices.
- Minimum password length is at least 12 characters.
- Complexity rules do not force predictable patterns like “Password1!”.
🔁 Login Attempts
Unlimited login attempts is an open invitation for automated password guessing. These checks confirm attackers can’t just keep trying.
- Rate limiting is in place, such as a maximum of 5 attempts per IP or account per minute.
- Repeated failed attempts trigger a lockout or delay.
- Error messages are generic (“Invalid email or password”) and do not reveal whether an email is registered.
📱 Multi-Factor Authentication
A stolen password should not be enough to get in. These checks confirm a second factor is actually required, not just offered.
- MFA or 2FA is available, and required for admin accounts at minimum.
- OTP codes expire quickly (5 to 10 minutes) and can only be used once.
⏱️ Sessions
A login is only as secure as the session it creates afterward. These checks catch sessions that stay open longer than they should.
- Session tokens are random and unpredictable.
- Sessions expire automatically after a reasonable period of inactivity.
- Logout invalidates the session on the server, not just in the browser.
✉️ Password Reset
Reset flows are a favourite target because they’re often built as an afterthought. These checks close the most common gaps.
- Reset tokens are single-use and expire quickly, within about 15 minutes.
- Reset tokens do not sit exposed in the URL, where they can leak through browser history or server logs. See our breakdown of password reset tokens in URLs.
- The reset flow never reveals whether a given email is registered.
None of these checks require deep security expertise. Most are configuration decisions made once, early in a project, and then quietly forgotten as everything else moves on. Working through this list after any change to your login system, or once a year as a matter of habit, catches drift before it turns into a real vulnerability worth worrying about.
This checklist pairs well with our deeper guides on authentication. Explore the full Authentication hub for more.