A lockout policy (or use of php sleep function) to protect a login form could in some cases be even worse (or much worse) than a brute force attack, in particular if the attacker has access to user account login data: for example, in cases where public usernames are used for authentication, which is bad in general, if avoidable. The attacker could lock registered users again and again (DOS), leading to a real disaster. Never do that on a public web site.
It is probably much easier for an attacker to exploit an account locking system based on login attempts, than it is for a developer to create an effective one.
A better solution is to keep good practices: hide as much information as possible, as usual, while forcing users to create good passwords. This way, brute force attacks could be totally useless: the attacker will need too many resources to achieve something. In this scenario, for example, use emails only to log in (or any other user data that is not public), never public usernames, and never make them visible and collectable to other users or public.
But do not apply a lockout policy on user accounts.
A good DOS attack is made from many different ips. That said, you could apply a lockout policy on the web server to avoid DOS and Brute Force attacks by detecting excessive requests from a single IP (requests of any kind, and not only on a login page or form). Shared hostings often adopt policies of this kind in my knowledge and you generally do not have to worry too much about since you cannot change them. But if you have to configure a dedicated server this can be a bit more tricky: this is a subject for server administrators, more than web developers. If you use Apache, you could be interested in something like this: http://www.crucialp.com/resources/tutorials/server-administration/flood-protection-dos-ddos-protection-apache-1.3-2.0-mod_dosevasive-avoiding-denial-of-service-attacks.php