You shouldn't build a login & signup system that only securely and effectively authenticates users; instead, create a system that makes sure your application does more than just securely authenticate users by adding an extra layer of security, which includes the following:
Create a login attempt tracker
Always add a CAPTCHA to your signup/registration form.
Yeah, this is information that you may get from a senior dev or probably too late after your system or user has been exploited. Note these concepts can be implemented with any programming language.
So let's explain the reasons and how to properly implement these extra layers.
