diff --git a/.env.example b/.env.example
index 453ab33..965f191 100644
--- a/.env.example
+++ b/.env.example
@@ -6,6 +6,7 @@ MONGODB_URI=mongodb://127.0.0.1:27017
 MONGODB_DB=torrent_console
 
 # 站点访问密码（留空则站点完全开放；设置后进入站点需在 /gate 输入此密码，cookie 由服务端校验）
+# 同一 IP 输错 5 次锁定 1 小时
 WEBPASSWORD=
 
 # 访问搜索源时使用的 HTTP 代理（国内网络连不上公开磁力站时配这里）
diff --git a/app/layouts/default.vue b/app/layouts/default.vue
index a5dfeff..6a7bef5 100644
--- a/app/layouts/default.vue
+++ b/app/layouts/default.vue
@@ -19,6 +19,11 @@ const mongoPill = computed(() => {
     ? { cls: 'on', text: 'MONGO' }
     : { cls: 'off', text: 'MONGO 未连接' }
 })
+
+async function logout() {
+  await $fetch('/api/logout', { method: 'POST' }).catch(() => {})
+  await navigateTo('/gate', { reload: true })
+}
 </script>
 
 <template>
@@ -49,6 +54,7 @@ const mongoPill = computed(() => {
             <i class="dot" />
             {{ mongoPill.text }}
           </NuxtLink>
+          <button v-if="health?.authed" class="pill" type="button" @click="logout" title="退出登录">退出</button>
           <select class="pill lang-select" v-model="lang" title="Language" aria-label="Language">
             <option value="en">EN</option>
             <option value="zh">中文</option>
diff --git a/app/pages/gate.vue b/app/pages/gate.vue
index c011ac2..3075661 100644
--- a/app/pages/gate.vue
+++ b/app/pages/gate.vue
@@ -1,11 +1,39 @@
 <script setup lang="ts">
-import { ref } from 'vue'
+import { ref, onBeforeUnmount } from 'vue'
 
 const password = ref('')
 const error = ref('')
 const loading = ref(false)
+const lockRemaining = ref(0)
+let timer: ReturnType<typeof setInterval> | undefined
+
+function fmt(total: number): string {
+  const h = Math.floor(total / 3600)
+  const m = Math.floor((total % 3600) / 60)
+  const s = total % 60
+  const pad = (n: number) => String(n).padStart(2, '0')
+  return h > 0 ? `${pad(h)}:${pad(m)}:${pad(s)}` : `${pad(m)}:${pad(s)}`
+}
+
+function startLock(sec: number) {
+  lockRemaining.value = sec
+  if (timer) clearInterval(timer)
+  timer = setInterval(() => {
+    lockRemaining.value -= 1
+    if (lockRemaining.value <= 0 && timer) {
+      clearInterval(timer)
+      timer = undefined
+      error.value = ''
+    }
+  }, 1000)
+}
+
+onBeforeUnmount(() => {
+  if (timer) clearInterval(timer)
+})
 
 async function unlock() {
+  if (lockRemaining.value > 0) return
   if (!password.value) {
     error.value = '请输入密码'
     return
@@ -13,16 +41,26 @@ async function unlock() {
   loading.value = true
   error.value = ''
   try {
-    const res = await $fetch<{ ok?: boolean; enabled?: boolean }>('/api/unlock', {
+    const res = await $fetch<{ ok?: boolean; enabled?: boolean; locked?: boolean; remainingSec?: number }>('/api/unlock', {
       method: 'POST',
       body: { password: password.value }
     })
     if (res && (res.ok || res.enabled === false)) {
       await navigateTo('/', { reload: true })
+    } else if (res && res.locked) {
+      error.value = '尝试次数过多，账户已锁定'
+      startLock(res.remainingSec || 3600)
+    } else {
+      error.value = '密码错误'
     }
   } catch (e: unknown) {
-    const msg = (e as { data?: { statusMessage?: string } })?.data?.statusMessage
-    error.value = msg === 'invalid password' ? '密码错误' : '验证失败'
+    const data = (e as { data?: { statusMessage?: string; remainingSec?: number } })?.data
+    if (data?.statusMessage === 'locked') {
+      error.value = '尝试次数过多，账户已锁定'
+      startLock(data.remainingSec || 3600)
+    } else {
+      error.value = '验证失败'
+    }
   } finally {
     loading.value = false
   }
@@ -41,13 +79,15 @@ async function unlock() {
         class="input"
         placeholder="访问密码"
         autofocus
+        :disabled="lockRemaining > 0"
         @keyup.enter="unlock"
       />
-      <button class="btn btn-primary" type="submit" :disabled="loading">
+      <button class="btn btn-primary" type="submit" :disabled="loading || lockRemaining > 0">
         <span v-if="loading" class="spin" />
         {{ loading ? '验证中' : '进入' }}
       </button>
       <p v-if="error" class="err small">{{ error }}</p>
+      <p v-if="lockRemaining > 0" class="err small">锁定剩余 <span class="mono">{{ fmt(lockRemaining) }}</span></p>
     </form>
   </div>
 </template>
diff --git a/app/types/api.ts b/app/types/api.ts
index 0675405..051eb3e 100644
--- a/app/types/api.ts
+++ b/app/types/api.ts
@@ -101,4 +101,5 @@ export interface HealthResponse {
   enabledProviders: string[]
   searchProxy: string
   clients: { id: string; type: string; name: string; endpoint: string; enabled: boolean }[]
+  authed: boolean
 }
diff --git a/app/utils/i18n-dict.ts b/app/utils/i18n-dict.ts
index 4ec17f8..bec3459 100644
--- a/app/utils/i18n-dict.ts
+++ b/app/utils/i18n-dict.ts
@@ -235,7 +235,13 @@ export const zh2en: Record<string, string> = {
   '验证中': 'Verifying…',
   '密码错误': 'Wrong password',
   '验证失败': 'Verification failed',
-  '请输入密码': 'Please enter the password'
+  '请输入密码': 'Please enter the password',
+
+  // ===== 锁定 / 退出 =====
+  '退出': 'Logout',
+  '退出登录': 'Log out',
+  '尝试次数过多，账户已锁定': 'Too many failed attempts, account locked',
+  '锁定剩余': 'Locked: '
 }
 
 export const en2zh: Record<string, string> = Object.fromEntries(
diff --git a/server/api/health.get.ts b/server/api/health.get.ts
index 38ad119..3e2448a 100644
--- a/server/api/health.get.ts
+++ b/server/api/health.get.ts
@@ -3,7 +3,7 @@ import { listProviders } from '../utils/search'
 import { checkWebTorrent } from '../utils/torrent'
 import { loadSettings } from '../utils/appconfig'
 
-export default defineEventHandler(async () => {
+export default defineEventHandler(async (event) => {
   const [mongo, webTorrent, settings] = await Promise.all([mongoStatus(), checkWebTorrent(), loadSettings()])
   return {
     ok: true,
@@ -13,6 +13,7 @@ export default defineEventHandler(async () => {
     providers: listProviders(),
     enabledProviders: settings.enabledProviders,
     searchProxy: settings.searchProxy ? '已配置' : '未配置',
-    clients: settings.btClients.map((c) => ({ id: c.id, type: c.type, name: c.name, endpoint: `${c.host}:${c.port}`, enabled: c.enabled !== false }))
+    clients: settings.btClients.map((c) => ({ id: c.id, type: c.type, name: c.name, endpoint: `${c.host}:${c.port}`, enabled: c.enabled !== false })),
+    authed: getCookie(event, 'web_unlock') === '1'
   }
 })
diff --git a/server/api/logout.post.ts b/server/api/logout.post.ts
new file mode 100644
index 0000000..667821e
--- /dev/null
+++ b/server/api/logout.post.ts
@@ -0,0 +1,11 @@
+// 退出登录：清除 HTTP-only 的访问 cookie
+export default defineEventHandler((event) => {
+  if (!process.env.WEBPASSWORD) return { ok: true }
+  setCookie(event, 'web_unlock', '', {
+    httpOnly: true,
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 0
+  })
+  return { ok: true }
+})
diff --git a/server/api/unlock.post.ts b/server/api/unlock.post.ts
index 7de9399..b63391e 100644
--- a/server/api/unlock.post.ts
+++ b/server/api/unlock.post.ts
@@ -1,10 +1,20 @@
-// 校验站点访问密码（来自环境变量 WEBPASSWORD），成功后写入 HTTP-only cookie
+import { getRequestIP } from 'h3'
+import { gatePassword, isGateEnabled, checkLock, registerFailure, registerSuccess } from '../utils/gate'
+
+// 校验站点访问密码（来自环境变量 WEBPASSWORD），成功后写入 HTTP-only cookie；
+// 同一 IP 输错 5 次锁定 1 小时。
 export default defineEventHandler(async (event) => {
-  const password = process.env.WEBPASSWORD
-  if (!password) return { enabled: false }
+  if (!isGateEnabled()) return { enabled: false }
+
+  const ip = getRequestIP(event, { xForwardedFor: true }) || 'unknown'
+  const lock = checkLock(ip)
+  if (lock.locked) {
+    return { ok: false, locked: true, remainingSec: lock.remainingSec }
+  }
 
   const body = await readBody<{ password?: string }>(event)
-  if (body.password === password) {
+  if (body.password === gatePassword()) {
+    registerSuccess(ip)
     setCookie(event, 'web_unlock', '1', {
       httpOnly: true,
       sameSite: 'lax',
@@ -13,5 +23,10 @@ export default defineEventHandler(async (event) => {
     })
     return { ok: true }
   }
-  throw createError({ statusCode: 401, statusMessage: 'invalid password' })
+
+  const after = registerFailure(ip)
+  if (after.locked) {
+    return { ok: false, locked: true, remainingSec: after.remainingSec }
+  }
+  return { ok: false, locked: false }
 })
diff --git a/server/middleware/auth.ts b/server/middleware/auth.ts
index eacc8d9..b669b29 100644
--- a/server/middleware/auth.ts
+++ b/server/middleware/auth.ts
@@ -10,6 +10,7 @@ export default defineEventHandler((event) => {
   // 解锁接口、门禁页与 Nuxt 运行所需资源始终放行
   if (
     url === '/api/unlock' ||
+    url === '/api/logout' ||
     url === '/gate' ||
     url.startsWith('/_nuxt') ||
     url.startsWith('/__nuxt') ||
diff --git a/server/utils/gate.ts b/server/utils/gate.ts
new file mode 100644
index 0000000..78e0b26
--- /dev/null
+++ b/server/utils/gate.ts
@@ -0,0 +1,42 @@
+// 站点门禁的失败次数 / 锁定状态（按客户端 IP，内存存储，单进程有效）
+const MAX_ATTEMPTS = 5
+const LOCK_MS = 60 * 60 * 1000 // 锁定 1 小时
+
+type Attempt = { count: number; lockedUntil: number }
+const attempts = new Map<string, Attempt>()
+
+export function gatePassword(): string {
+  return process.env.WEBPASSWORD || ''
+}
+
+export function isGateEnabled(): boolean {
+  return !!gatePassword()
+}
+
+export function checkLock(ip: string): { locked: boolean; remainingSec: number } {
+  const e = attempts.get(ip)
+  if (!e) return { locked: false, remainingSec: 0 }
+  const now = Date.now()
+  if (e.lockedUntil > now) {
+    return { locked: true, remainingSec: Math.ceil((e.lockedUntil - now) / 1000) }
+  }
+  if (e.lockedUntil > 0) {
+    attempts.delete(ip) // 锁定已过期，重置计数
+  }
+  return { locked: false, remainingSec: 0 }
+}
+
+export function registerFailure(ip: string): { locked: boolean; remainingSec: number } {
+  const e = attempts.get(ip) || { count: 0, lockedUntil: 0 }
+  e.count += 1
+  if (e.count >= MAX_ATTEMPTS) {
+    e.lockedUntil = Date.now() + LOCK_MS
+    e.count = 0
+  }
+  attempts.set(ip, e)
+  return checkLock(ip)
+}
+
+export function registerSuccess(ip: string): void {
+  attempts.delete(ip)
+}