Sign-in attempts are logged. Five failed attempts trigger a 15-minute restriction.