Three attempts per challenge. A wrong flag costs one attempt. After the third wrong attempt the challenge is locked permanently (the lock lives in your browser). Hints unlock in order and every hint deducts points from that challenge.