It is required to make the site accessible to only login user. There should be option for new user registration, forget password, change password, set password to be expired after every 90 days. last 3 password cannot be used while change password. after 15 minutes idle time of activities after login, the user should be logout. All the settings options for the login management should be configuration in a file system.