 <p>The short answer is Spring Security does not provide any implementation to protect against brute force attempts against an account.</p> <p>However, it does provide you with the means to implement your own strategy for protecting against them. Typically you will need to implement a callback on a failed authentication event. What you do from here depends on what the appropriate course of action is for your application. Some applications will simply increment a session variable of failed attempts and once that threshold is reached simply ignore any further attempts.</p> <p>Other applications may need to persist this information along with the last failed attempt and lock the account by updating the domain instance after a specific number of failed attempts within a time period.</p> <p>The <a href="http://grails-plugins.github.io/grails-spring-security-core/guide/events.html" rel="nofollow">documentation</a> does a good job of explaining how to do this, but typically you will want to add the event listeners for the spring security core plugin into your <code>Config.groovy</code> like such:</p> <pre><code>grails.plugin.springsecurity.useSecurityEventListener = true grails.plugin.springsecurity.onInteractiveAuthenticationSuccessEvent = { e, appCtx -&gt; // Handle successful login } grails.plugin.springsecurity.onAbstractAuthenticationFailureEvent = { e, appCtx -&gt; // Handle failed login // example of how to obtain the session if you need it def request = grails.plugin.springsecurity.web.SecurityRequestHolder.getRequest() def session = request.getSession(false) } </code></pre>