Put a number of authentication attempts before disconnecting player. Maybe a line in the config: # Amount of times a player can put a wrong password before they are disconnected auth-attemps-before-disconnect: 1