title: Keeping track of failed login attempts
body: <p>This question is essentially language-agnostic, but in my case I'm using <a href="http://php.net/" rel="nofollow">PHP</a> for anyone who wants to know.</p>
  
  <p>I would like to keep track of the number of failed login attempts a user had, so that after <code>X</code> failed attempts a <a href="http://en.wikipedia.org/wiki/CAPTCHA" rel="nofollow">CAPTCHA</a> is displayed. The only purpuse this would have is preventing brute-force attacks. It doesn't have to be an extremely secure way, just annoying enough to delay whoever is brute-forcing.</p>
  
  <p>I was thinking of creating a session variable <code>$_SESSION['failedLoginAttempts']</code> and to increase it every time a failed login attempt is detected. The attacker could still alternate browsers or delete his cookies to keep going, but this would make him (i.e. whatever tool he's using to perform the brute-force) waste a couple of seconds more for every attempt, so the number of attempts would be greately lowered.</p>
  
  <p>From a couple attacks from second to a couple attacks per minute would be ideal, then the attack would be negligible.</p>
  
  <p>Is this approach correct or am I missing something? Also, what's the best practice in these cases?</p>