Security Best Practice on failed login attempts

Hi,
I am designing a login mechanism for a website. Presently, I am blocking the user account for 1 hour if there are 3 failed login attempts with-in 1 hour.
However, I want to know if there is any best practice that can be followed on failed login attempts.
Any help would be greatly helpful.
Thanks,
Dharmesh

re: Security Best Practice on failed login attempts

Blocking someone access for an hour after 3 log in attempts is one way you can prevent DOS attacks, and also make it more difficult for a person to try dictionary based attacks.

Another way to do it is to add a CAPTCHA to the log in page to confirm that it's not a script that is attempting to log in.

Some websites lock accounts completely after 3-5 failed attempts while others use things like RSA SecurID.

There are several things that can be done. You should determine which one is going to work the best for your situation.