diff --git a/protected_node.fork.inc b/protected_node.fork.inc
index e2fcfd2..f0df314 100644
--- a/protected_node.fork.inc
+++ b/protected_node.fork.inc
@@ -165,8 +165,16 @@ function protected_node_enter_any_password() {
  * Validate callback.
  *
  * Verify that the user entered the correct password.
+ *
+ * For the flood control, @see user_login_authenticate_validate().
  */
 function protected_node_enter_any_password_validate($form, &$form_state) {
+  $max_attempt = variable_get('protected_node_failed_password_ip_limit', 50);
+  $flood_window = variable_get('protected_node_failed_password_ip_window', 3600);
+  if (!flood_is_allowed('failed_protected_node_attempt_ip', $max_attempt, $flood_window)) {
+    form_set_error('password', t('Sorry, too many failed password attempts from your IP address. This IP address is temporarily blocked. Try again later.'));
+    return;
+  }
   // Note that global password cannot work here since we couldn't know where
   // to send the user otherwise.
   $nids = protected_node_get_nids_from_protected_pages_parameter();
@@ -185,6 +193,7 @@ function protected_node_enter_any_password_validate($form, &$form_state) {
     ->fetchField();
 
   if (empty($nid)) {
+    flood_register_event('failed_protected_node_attempt_ip', $flood_window);
     form_set_error('password', t('Incorrect password!'));
   }
   else {
diff --git a/protected_node.redirect.inc b/protected_node.redirect.inc
index 422677e..ec7d791 100644
--- a/protected_node.redirect.inc
+++ b/protected_node.redirect.inc
@@ -149,8 +149,16 @@ function protected_node_enterpassword() {
 
 /**
  * Verify that the user entered the correct password.
+ *
+ * For the flood control, @see user_login_authenticate_validate().
  */
 function protected_node_enterpassword_validate($form, &$form_state) {
+  $max_attempt = variable_get('protected_node_failed_password_ip_limit', 50);
+  $flood_window = variable_get('protected_node_failed_password_ip_window', 3600);
+  if (!flood_is_allowed('failed_protected_node_attempt_ip', $max_attempt, $flood_window)) {
+    form_set_error('password', t('Sorry, too many failed password attempts from your IP address. This IP address is temporarily blocked. Try again later.'));
+    return;
+  }
   // @todo We do not want to check the global password if there is a local
   // password (i.e. extract local password instead of comparing).
   // @todo The protected_node_nid parameter should be extracted from the
@@ -203,6 +211,7 @@ function protected_node_enterpassword_validate($form, &$form_state) {
     }
 
     if (empty($nid)) {
+      flood_register_event('failed_protected_node_attempt_ip', $flood_window);
       form_set_error('password', t('Incorrect password!'));
     }
   }
diff --git a/protected_node.settings.inc b/protected_node.settings.inc
index e65f581..9fc33cb 100644
--- a/protected_node.settings.inc
+++ b/protected_node.settings.inc
@@ -602,6 +602,27 @@ function protected_node_admin_settings() {
     );
   }
 
+  // Flood control options.
+  $form['protected_node_flood_control'] = array(
+    '#type' => 'fieldset',
+    '#title' => t('Protected node flood control'),
+    '#collapsible' => TRUE,
+  );
+
+  $form['protected_node_flood_control']['protected_node_failed_password_ip_limit'] = array(
+    '#type' => 'select',
+    '#title' => t('Failed password (IP) limit'),
+    '#options' => drupal_map_assoc(array(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 20, 30, 40, 50, 75, 100, 125, 150, 200, 250, 500)),
+    '#default_value' => variable_get('protected_node_failed_password_ip_limit', 50),
+  );
+
+  $form['protected_node_flood_control']['protected_node_failed_password_ip_window'] = array(
+    '#type' => 'select',
+    '#title' => t('Failed password (IP) window'),
+    '#options' => array(0 => t('None (flood control disabled)')) + drupal_map_assoc(array(60, 180, 300, 600, 900, 1800, 2700, 3600, 10800, 21600, 32400, 43200, 86400), 'format_interval'),
+    '#default_value' => variable_get('protected_node_failed_password_ip_window', 3600),
+  );
+
   // View modes.
   $node_info = entity_get_info('node');
   $view_modes = array();