How not to build a login & signup system

You shouldn't build a login & signup system that only securely and effectively authenticates users; instead, create a system that makes sure your application does more than just securely authenticate users by adding an extra layer of security, which includes the following: Create a login attempt tracker Always add a CAPTCHA to your signup/registration form. Yeah, this is information that you may get from a senior dev or probably too late after your system or user has been exploited. Note these concepts can be implemented with any programming language. So let's explain the reasons and how to properly implement these extra layers. Reason The reason why you should always add CAPTCHA to your signup/registration form is to prevent automated systems or bots from flooding your servers and creating fake accounts. The login page doesn't necessarily always require a captcha because it is not a good user experience to always require an already existing user to answer the c