Blocking IPs of failed login attempts is often touted as one surefire way to cut off bad actors at the knees. While there is some truth to this, anyone can easily change their IP in seconds, potentially turning this exercise into an endless cat-and-mouse game. If you have a limited number of users, you might want to consider whitelisting IPs instead, but keep in mind that most ISPs (Internet Service Providers) do not assign static IPs to their customers. Users might also choose to log in from a different location (whether it's an emergency or otherwise), potentially turning whitelisting into a nightmare.