Updating transient value frequently

Question

Is it alright conceptually to update transient value frequently.

I am building up a login form & every time user enters invalid credentials, store the incorrect attempts.

So I am using user IP address & creating a key like "login_data_IPXXX" with an array value. There is a lot more information other than incorrect attempts which I would like to store.

Before now I was storing it in a session key & found that sessions shouldn't be used in WP.

Then I thought about using transients, as this value gets updated frequently & is a temporary data, I am confused whether I should use transient or not. If not, what should be used instead?

Cookies is also not an appropriate fit here.

Answer 1

For your use case, no.

• Using PHP sessions - will not work on most hosts, and will make that data available only to the browser and the current PHP request. This severely limits the usefulness
• Using Cookies - will work everywhere but have the same issue that you can't persist server side or track things
• Using transients - will work to a point, you'll have a row in the options table for every visitor though, which is the crux of the issue. Transients also get garbage collected, and there's a chance that every update you make will trigger a new options row and an old transient to be cleaned up

Fundamentally the approach of storing a collection of data in an individual unit is flawed, and collecting additional data such as clicks, and the details used, will cause more problems, and in most cases be completely ineffectual:

• There are legal complications due to privacy
• There are security complications as misspelling a password by 1 character reveals the users password in the logs
• Storing an IP and a username means that you've stored identifiable information, which means you have to worry about compliance with data protection laws such as the GPDR
• Most failed login attempts are from bots, so there won't be any clicks, there may not even be a browser. They'll open a direct request bypassing the login page straight to the handler and check the response for success. Bots don't even check you're running WordPress and fire both WP/Drupal/Joomla exploits and login attempts indiscriminately
• Failed login attempts can quick spiral out of control, with even small low traffic sites recieving spikes of hundreds or even thousands of attempts. If you're storing each visitor in a single option or transient, that could be hundreds or thousands of additional table rows. You could be constructing for yourself a resource exhaustion exploit

So instead, I would suggest:

• tracking the minimal information possible, aka an IP and how many times it attempted, perhaps just a list of timestamps that you can count
• Either store it in a single option, with autoload set to false so it doesn't slow down your site, or use a dedicated table