Unfortunately, this is one of those areas where there's not a "one size fits all" solution. Blocking an IP that submits too many bad login attempts is a pretty common solution, but it has pitfalls. Many networks are behind NATted firewalls, so all connections appear to come from the same address. So in blocking an attacker, you may also be blocking innocent by-standers who are on the same network.

This might be acceptable for some web sites, but in other cases it might not be.