Team login only. Website visitors never need an account.
5 wrong attempts lock the account for 15 minutes.