...
- Lock the user account after a certain number of failed attempts, for a period of time. For instructions on setting this up, see User Account Locking and Account Disabling.
- Present a reCaptcha after a certain number of failed attempts before trying again. A reCaptcha can determine if the system is dealing with a human or an automation. For instructions on setting this up, see Setting Up ReCaptcha.