Limit failed logins attempts

Hi guys, I would like to know what do you suggest to implement a limit for failed login attempts. I thought that might be a good idea, to define a session variable called ( failedattempts ), then check and if $failedattempts is greater than, suppose, 4 write to a Database ( ip, username and last-time-attempt ). If ater that, the user/bot tries again to login unsuccessfully, then the system should ban that user & ip combination. Some questions about this situation: - Do you think that is a good idea to use sleep() ?. - How should I send a 503 HTTP error to the user after 5 attempts ? - Is this a good idea to do all this work for this security purpose ? - Do you know/suggest a better way to solve this? Thanks in advance, Juan