What is the best way to temporary block login attempts while not blocking the IP because this will be on networks with many people using the same IP and not reliant on a cookie since that can be easily cleared. Is there another way or is there no real way to do that?
This would be for a website login page. LAMP environment.
I would want to block brute force I am already locking out specific account attempts at 5 minutes intervals using the database to save each attempt with a datetime but I also want to block people who might be trying different accounts if they keep failing across multiple account attempts. I just don't know how to identify them other then the IP which I can't use or a cookie which can get deleted easily.