Protecting a CI site

Yeah - don't use md5. You should go with bcrypt or argon2 as they provide more options to hash passwords. For example cost(10) is the standard cost for hashing passwords with bcrypt. Higher values result in stronger hashes but need more hardware power. I currently use bcrypt with cost of 14. Same for Argon2 algorythm, which provides options for "memory_cost", "time_cost" and "threads".