The idea is to not even accept the correct password during lock down.
But before implementing a lock down system, it makes sense to look at the attack cases:
a specific user is targeted
If the attacker is targeting a specific user, denying or delaying logins after a couple of wrong tries is helpful. A common mistake with the delaying approach is not to prevent parallel logins attempts.
Another common approach is to use CAPTCHAs to slow down the attacker. One needs to keep in mind that many standard CAPTCHAs are already broken. When the NY-Times voting was manipulated, the attackers crafted a special interface which display many CAPTCHAs on one page.
The attacker may try only two login attempts every day over a long period of time (we actually see this in Stendhal from time to time). Displaying the number of failed login attempts after a successful login may help here. It's important to not say "0 failed login attempts" every time because this will just teach the people to ignore that message. Only show the warning if there was at least one failed login attempt.
A list of ip-addresses and timestamps of the last login attempts (successful or not) may help, at least for users who care about security and have a certain level of knowledge.
any user is target
In cases in which a really large number of logins are attempted, the attackers often pick a fixed password and brute force the account names. This means that a threshold of three login attempts per account will not be triggered.
So failed login attempts need to be tracked on a cross account basis, for example based on the ip-addresses.
locking out a large number of users
Implementing the counter measurements mentioned above creates a new vulnerability: An attacker can lockout a large number of accounts. In some cases this may cause far greater damage to a site than a small number of hacked accounts.
IP-based counting can help to mitigate this attack vector. Or it can give a lever to it in situations in which lots of people are behind the same proxy server (at an university, or public wlan, etc.)
locking out a specific account
In addition to the last section, an attacker may try to lockout a specific account. For example someone who is bidding against them on an auction.
It may be possible to use a second channel to allow the account owner to re-enable his account. For example by sending a mobile text message or email with a code.