I'm building an application in PHP with a private access. There are two ways to log in:

* Login form: username and password
* Cookie: remembered cookie with hashed information (username, salt, etc.)

To prevent robots doing a brute force attack, the server creates a session (a cookie with session\_start), after 4 attempts, the user has to wait 5 seconds before trying again. I'm using the superglobal variable $\_SESSION to check how many times someone tries to connect.

My concern is about users that don't allow cookies. In that case, they won't have to wait 5 seconds every 4 attempts. I'm a bit confused regarding the best way to prevent brute force: 

1. Creating a login table in the database that checks how many times an IP tries to connect
2. Or simply preventing users without session cookie from connecting

Thanks,