I manage multiple WordPress installs (all related/cross-linked) and I've been getting hit hard with brute force attempts for the past few weeks, enough to crash my servers on multiple occasions. I went ahead and installed WP Limit Login Attempts, but I want something better. I'm still seeing spikes in resource utilization, I imagine because even though the user/password check against the DB is being skipped, the WordPress login code is still being executed for every request.
My stack is Nginx in front of Apache/PHP-FPM. Is there a tool out there I can use to let Nginx do the blocking?