Good, but not good enough

Good job on the 404, but if some IP is hammering failed attempts, why not give the option to block an IP after X attempts? It’s like “your house is on fire, but I’m going to watch it burn”