The Facts About Password Security

What is the current password attempt policy set to? If you don’t have 2FA turned on you can keep guessing a users password without getting a recaptcha window. Someone could use a brute force program to gain access to a users account.