Slow Down Failed Login Attempts

Waits a second or two before answering a failed login, which makes password-guessing bots far slower without bothering real users.

Code

add_action( 'wp_login_failed', function () {
    // Random 1 to 2 second delay.
    usleep( wp_rand( 1000000, 2000000 ) );
} );

Each delayed request keeps a PHP worker busy; combine with a login limiter on busy sites.

Install WPIDE on your WordPress site (it is free) and open Code Snippets.
Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
It is added inactive: review the code and settings, then switch it on.