Mitigate brute force attacks on login page

[eluser]WanWizard[/eluser]
Not sure a captcha will protect you, it just means the attacker has to write a smarter script. You'll have to mitigate server side.

I mitigate this by adding a delay before a second attempt to login can be made. The first few (configurable) are delay free, after that the delay is added, and the more attempts are being made, the longer the delay is.

After a (configurable) number of attempts the source IP is blacklisted and the delay is reset, to avoid this being used as a DDOS (you don't want the legitimate users to be locked out of their own accounts).