Passwords, two-factor authentication and sessions
Storage
A dedicated password-hashing algorithm designed to be slow and memory-hard, with a salt per user. Never reversible encryption and never a fast hash.
A reasonable minimum length, a check against leaked-password lists, and no forced periodic rotation — it leads to worse passwords.
A second factor
An authenticator app or a hardware key. Text messages beat nothing but are weaker. Keep backup codes, and plan a recovery path that doesn't negate all the protection.
Sessions
A token with an expiry, an option to revoke on the server side, and a list of connected devices the user sees and can disconnect. Rotate the session identifier on every login and every password change.
Going deeper
Rate-limit attempts by account and by source, and add a growing delay. And alert the user to significant events — a login from a new device, an email change, two-factor turned off — because the user is often the first to notice an account takeover.