Let us being by creating the tables you will need.

First off lets create 2 tables:
One with these fields usernames and passwords (encryption recommened), sec_level, locked
One will be used to log the failed login attempts (date_time, username, ip_address)

Tables explained:

SEC_LEVEL - The security level of the user.  10 = BAN, 30 = USER, 50 = ADMIN

LOCKED - Flag which determines if the account is locked or unlocked.

We will be using the built in login funcatino that CF8 offers called <cflogin>

This tutorial will not be covering how to use the cflogin function,  here is a great tutorial if you are not familiar with cflogin http://tutorial67.easycfm.com/

---Application.cfm----
<!---START CFLOGIN-à
<cflogin>
...check login here...
<cfif login passed>
Do this
<cfelse login failed>

<!---Get TimeStamp--->
<cfset todayDate = Now()>
<cfset month = #DatePart("m", todayDate)#>
<cfset day = #DatePart("d", todayDate)#>
<cfset year = #DatePart("yyyy", todayDate)#>
<cfset hour = #DatePart("h", todayDate)#>
<cfset min = #DatePart("n", todayDate)#>
<cfset sec = #DatePart("s", todayDate)#>

Once a failed login occurs we want to insert the failed attempt into the log table.  We want to log the username, date_time and ip address.
<!---LOG FAILED ATTEMPT--->
<cfquery name="update">  
INSERT INTO log
(date_time,username,ip_address)
VALUES
('#month#/#day#/#year# #hour#:#min#:#sec#','#cflogin.name#','#CGI.REMOTE_HOST#')
</cfquery>

Next we need to check to see how many failed attempts have occurred for this username and ip address

<cfquery name="check">  
SELECT *
FROM log
WHERE username = '#cflogin.name#' AND ip_address = '#CGI.REMOTE_HOST#'
</cfquery>

We are going to set a couple variables: right_now which the current timestamp and an attempt counter.

<cfset right_now = '#month#/#day#/#year# #hour#:#min#:#sec#'>
<cfset attempt = 0>

We are going to loop through the check query which will get the offset time of the timestamp in the table (check.date_time) and the current timestamp (right_now)

<cfloop query="check">
<cfset offset = #DateDiff("N", check.date_time,right_now)#> 

If the offset of the times are less than 15 minutes we are going to add one to the fail attempt counter.

<cfif offset LT 15>
<cfset attempt = #attempt# + 1>
</cfif>  

When the attempt counter hits 5 attempts we execute an update statement which locks the account.

<!---If there are 5 failed attempts within 15 mins lock the account--->
<cfif attempt EQ 5>
<cfquery name="update">  
UPDATE users
SET locked = 1
WHERE username = '#cflogin.name#'
</cfquery>
</cfif>
</cfloop>
<cfset loginmessage="Invalid Login">
<cfinclude template="login.cfm">  
<cfabort>
</cfif>
</cflogin>
<!---END CFLOGIN-à

Sometimes its easier to automatically unlock the account rather than getting that phone call at 2 in the morning and manually unlocking it, so here is some code that will automically unlock the about after 15 minutes of the last failed attempt.  It will best go after a successful login.

<cfif check.locked EQ 1>
<cfset todayDate = Now()>
<cfset month = #DatePart("m", todayDate)#>
<cfset day = #DatePart("d", todayDate)#>
<cfset year = #DatePart("yyyy", todayDate)#>
<cfset hour = #DatePart("h", todayDate)#>
<cfset min = #DatePart("n", todayDate)#>
<cfset sec = #DatePart("s", todayDate)#>

<cfquery name="check_log">  
SELECT MAX(date_time) as dt
FROM log
WHERE username = '#username#'
</cfquery>

<cfset right_now = '#month#/#day#/#year# #hour#:#min#:#sec#'>

<cfset offset = #DateDiff("N", check_log.dt,right_now)#>

<!---If 15 mins has pasted since the last failed attempt, unlock the account and proceed with login--->

<cfif offset GTE 15>
<cfquery name="update">  
UPDATE users
SET locked = 0
WHERE username = '#username#'
</cfquery>
</cfif>
</cfif>

If you enjoyed this tutorial please view my other tutorials by clicking here http://www.easycfm.com/coldfusion/tutorials/index.cfm?tutorial_author=Micah%20Downing