It's a tradeoff between the required security level, the cost and the amount of hassle it adds to the user's workday. If the purpose is to protect the members of a local fishing club's site from hackers, that's much different than a national security web site.
Servers assign access levels to users like Admin, User and Guest that controls what the user is allowed to do on the server.
There's the username and password routine we all know well. Some of them just compare the information to a user file and some create a session ID that follows their navigation through the site and expire on exit. Some medium security systems add a second set of revolving questions like your high school, your mom's maiden name. Others include a graphics image of distorted alpha numeric text to prevent OCR software from reading it.
There are also very complex biometrics systems that maximize the security and cost but minimize the hassle. It all depends on security level, cost and how much hassle the system can tolerate.