title: php login throttling by detecting ALL failed attempts per minute
body: <p><strong>Background info:</strong> I have a website with small number of members. The page is in pure php7 + html + css. No javascipt, no databases. I use json to keep user info. I send Content Security Policy script-src 'none' header so i cannot use any javascript. I am a new programmer so I like keeping things simple. </p>
  
  <p><strong>What I want:</strong> Somehow log ALL failed login attempts (from ALL ips) and if i get >30 failed login attempts per minute then throttle login (say) by n seconds. This would protect me against bruteforce by proxy hopping as well as bruteforcing from a single ip. How should I implement this?</p>
  
  <p><strong>What to avoid:</strong> If I write failed login attemps to a file then there should be some check to make sure that the file is not growing too rapidly. I do not want to DOS myself trying to write constantly to a growing file. Also how should I delete old entries?</p>
  
  <p><strong>Edit:</strong> What I need is not code but an algorithm of achieving this.</p>
  
  <p>An idea I have involves two files: failed_attemts.txt and status.txt. (Or json.) The first file contains time stamps of failed attemps and the second one contains a single line to indicate whether the server is in regular mode or throttling mode.</p>
  
  <p>Every time a failed attempt happens do the following:</p>
  
  <ol>
  <li>Check status.txt to see if we are in regular mode or throttling mode. If throttling, stay throttling. Else do the following:</li>
  <li>Append the time of the failed attempt as a new line to "failed_attemts.txt".</li>
  <li>Delete all lines that has time stamps older than one minute to keep the file size small.</li>
  <li>Check the file if there are >30 lines. </li>
  <li>If no continue as usual. </li>
  <li>If yes then go to into throttling mode and indicate it in status.txt.</li>
  </ol>
  
  <p>Throttling mode will simply consist of delaying the process of the login form by n seconds. I can add more fancy throttling methods later on if needed.</p>
  
  <p>I also need to write the beginning time of the throttling mode in status.txt so that I can leave the throttling mode after (say) 30 minutes (in step 1 above). </p>
  
  <p>The only weak point that I can see in this algorithm is that during a bruteforce attack the file status.txt is repeatedly read. But probably linux (ubuntu 16.04) will cache it into memory so it would be ok. (Am I right in this assumption?)</p>
  
  <p>Would my algorithm work? Any improvements? Better algorithms?</p>
  
  <p>Help appreciated.</p>