Because customer do not pay for security.

You need to create a database table. Collect IP addresses from failed logins. Cleanup this table regularly. Create another table with blocked IPs and keep it cleaned up too. You see it takes some effort and customers don't like to pay extra just for security.

As developer you should use frameworks which will take care about those problems. Also you might want to have a look at fail2ban.

Because customer do not pay for security.

You need to create a database table. Collect IP addresses from failed logins. Cleanup this table regularly. Create another table with blocked IP addresses and keep it cleaned up too. You see it takes some effort, and customers don't like to pay extra just for security.

As a developer you should use frameworks which will take care of those problems. Also you might want to have a look at fail2ban.