How to restrict after three times attempted user in asp.net

There are two option with you;

1. Either use a ASP.net membership provider class it has a default functionality implemented which locks he users after a certain unsuccessfull login attempts.

2. Add a cloumn"IsLockedOut" of datatype boolean ,to your user table and while a user attemts to login just count the number of attempts if its a unsucessfull login. When the count gets 3 set IslockedOut column in the table to "true" for that particular user.So even if the user tries to login with correct credentials he wont able to login. So when a user login you will have to check "Username","Password" and "IsLockedOut" in your logic.

If the IsLockedOut flag is false then allow the user to login if his username and password is correct else deny him to login even if other credentials are correct.

string LoginId = txtLoginId.Text.Trim().ToLower();
            string Password = txtPassword.Text.Trim();
            if (countloginid != LoginId)
            {
                count = 1;
            }

            Session["User_LoginId"] = LoginId;
            DataTable dtUser = objManageUsers.VerifyUserLogin(LoginId, Password);
            if (dtUser != null && dtUser.Rows.Count > 0)
            {
                if (LoginId == dtUser.Rows[0]["LoginId"].ToString() && Password == dtUser.Rows[0]["Password"].ToString())
                {
                    if (Convert.ToString(dtUser.Rows[0]["AccessLevel"]) != "1" && Convert.ToString(dtUser.Rows[0]["AccessLevel"]) != "9")
                    {
                        if (Convert.ToString(Session["Blok_UserEmailId"]) == LoginId)
                        {
                            this.errorMessageHtmlCell.Attributes.Add("style", "color:Red");
                            this.errorMessageHtmlCell.InnerText = "Your email id has been blocked";
                        }
                        else
                        {
                            Session["UserName"] = dtUser.Rows[0]["UserName"];
                            Session["UserId"] = dtUser.Rows[0]["UserId"];
                            Session["AccessLevel"] = dtUser.Rows[0]["AccessLevel"];
                            Session["DeletedFlag"] = dtUser.Rows[0]["DeletedFlag"];
                            Session["UpdateHRData"] = dtUser.Rows[0]["UpdateHRData"];
                            Session["UpdateOprnData"] = dtUser.Rows[0]["UpdateOprnData"];
                            Session["UpdateMktData"] = dtUser.Rows[0]["UpdateMktData"];
                            FormsAuthentication.RedirectFromLoginPage("Welcome!    " + Convert.ToString(Session["UserName"]) + " | ", true);
                            Response.Redirect("~/Home.aspx");
                        }
                    }
                    else
                    {
                        Session["UserName"] = dtUser.Rows[0]["UserName"];
                        Session["UserId"] = dtUser.Rows[0]["UserId"];
                        Session["AccessLevel"] = dtUser.Rows[0]["AccessLevel"];
                        Session["DeletedFlag"] = dtUser.Rows[0]["DeletedFlag"];
                        Session["UpdateHRData"] = dtUser.Rows[0]["UpdateHRData"];
                        Session["UpdateOprnData"] = dtUser.Rows[0]["UpdateOprnData"];
                        Session["UpdateMktData"] = dtUser.Rows[0]["UpdateMktData"];
                        FormsAuthentication.RedirectFromLoginPage("Welcome!    " + Convert.ToString(Session["Fname"]) + " " + Convert.ToString(Session["Lname"]) + " | ", true);
                        Response.Redirect("~/Default.aspx");

                    }
                }
                else
                {
                    this.errorMessageHtmlCell.Attributes.Add("style", "color:Red");
                    this.errorMessageHtmlCell.InnerText = "The login id or password you entered is incorrect.";
                    txtPassword.Focus();
                }
            }
            else
            {
                countloginid = Session["User_LoginId"].ToString();
                int sessioncount = count++;
                if (sessioncount == 3)
                {
                    Session["Blok_UserEmailId"] = Session["User_LoginId"];
                    this.errorMessageHtmlCell.Attributes.Add("style", "color:Red");
                    this.errorMessageHtmlCell.InnerText = "Your Email Id has been blocked";
                }
                else
                {
                    this.errorMessageHtmlCell.Attributes.Add("style", "color:Red");
                    this.errorMessageHtmlCell.InnerText = "The login id or password you entered is incorrect.";
                    txtPassword.Focus();
                }

You can directly use the following asp.net web.config to restrict user access after your choice of invalid attempts

<membership defaultProvider="Demo_MemberShipProvider">
    <providers>
        <add name="Demo_MemberShipProvider"
            type="System.Web.Security.SqlMembershipProvider"
            connectionStringName="cnn"
            enablePasswordRetrieval="false"
            enablePasswordReset="true"
            requiresQuestionAndAnswer="true"
            applicationName="/"
            requiresUniqueEmail="false"
            passwordFormat="Hashed"
            maxInvalidPasswordAttempts="5"
            minRequiredPasswordLength="5"
            minRequiredNonalphanumericCharacters="0"
            passwordAttemptWindow="10" passwordStrengthRegularExpression="">
    </providers>
</membership>

Change the maxInvalidPasswordAttempts="5" attribute to ="3"

Read complete article:
ASP.NET Membership and Role Provider[^]

Google [^]has the answer.

you can take a look some given link having similar question with solution
How User account be locked for 30 min after 5 unsuccessful login attempts with asp.net?[^]
Lock out users after three unsuccessful attempts without using a database[^]