diff --git a/gab/index.php b/gab/index.php
index 8245a7a..03a0de4 100644
--- a/gab/index.php
+++ b/gab/index.php
@@ -1,14 +1,55 @@
 <?php
 
-$correct_password = "GabrielIsDeBeste123";
+$password = "GabrielIsDeBeste123";
 
-if (!isset($_SERVER['PHP_AUTH_PW']) ||
-    $_SERVER['PHP_AUTH_PW'] !== $correct_password) {
+$ip = $_SERVER['REMOTE_ADDR'];
+$dir = __DIR__ . "/bans";
 
-    header('WWW-Authenticate: Basic realm="Foto Viewer"');
-    header('HTTP/1.0 401 Unauthorized');
-    exit('Wachtwoord vereist');
+if (!is_dir($dir)) {
+    mkdir($dir);
 }
+
+$file = "$dir/" . md5($ip) . ".json";
+
+$data = [
+    "attempts" => 0,
+    "ban_until" => 0
+];
+
+if (file_exists($file)) {
+    $data = json_decode(file_get_contents($file), true);
+}
+
+if (time() < $data["ban_until"]) {
+    die("Verbannen tot " . date("Y-m-d H:i:s", $data["ban_until"]));
+}
+
+if ($_SERVER["REQUEST_METHOD"] === "POST") {
+
+    if ($_POST["password"] === $password) {
+
+        unlink($file);
+        echo "Ingelogd!";
+        exit;
+
+    } else {
+
+        $data["attempts"]++;
+
+        if ($data["attempts"] >= 10) {
+            $data["ban_until"] = time() + 86400; // 1 dag
+        }
+
+        file_put_contents($file, json_encode($data));
+    }
+}
+?>
+
+<form method="post">
+    <input type="password" name="password">
+    <button>Login</button>
+</form>
+<?php
 $images = array_values(array_filter(scandir('.'), function($file) {
     return preg_match('/\.(jpg|jpeg|png|gif|webp)$/i', $file);
 }));