I'm not doing anything fancy. I'm just using Apache2 access control to password protect a directory.
I thought it would be smart if Apache would limit how frequently users can attempt to authenticate username and password from a given IP. It would be a cheap way to thwart brute force password attempts without DoSing legitimate user login attempts.
I searched and couldn't find anything specific to this and I was surprised. Is there a way to do it? Is there something better?