When a self-hosted password manager is exposed to the public internet, access rate limiting and IP blocking should be configured at the Vaultwarden or Nginx/Caddy reverse proxy layer to prevent brute-force attacks.