I have a requirement to show google reCaptcha on 2nd attempt on login screen.
But frankly speaking I consider it not the way to stop bots.
Because on server side I cannot tell whether this is the first or second login attempt unless the user chooses to send some kind of cookie along with the request so I can identify which number of login attempts he is trying - hence HTTP protocol is stateless in nature.
And I believe bots are not stupid to send some cookie that make the server figure out any information about them.
I heard about some sophisticated solutions like a js script to run on the login page load to generate some id and then to send this id to the server and make the server to check this id, but still an intelligent-enough bot can simulate all this actions. but this is not what I am asking about.