Login throttling is a defensive control that slows down or limits repeated sign-in attempts from the same user, IP address, device, or account. Instead of allowing unlimited password guesses, the system adds delays, temporary blocks, or stricter checks after repeated failures.
It matters because many attacks depend on speed and scale. Password spraying, credential stuffing, and simple guessing all become less effective when each attempt takes longer or is capped. Throttling does not replace strong passwords or multi-factor authentication, but it raises the cost of brute-force abuse and helps defenders spot suspicious authentication patterns. In real environments, it is often paired with account lockout policies, MFA prompts, risk scoring, and monitoring for unusual login bursts. For privileged accounts, throttling is especially important because a single weak admin password can expose far more data than a normal user account.