My suggestion would be to use some alternative log-in method such as client-side public-key authentication (like what ssh is doing, TLS also has support for it)

My suggestion would be to use some alternative log-in method such as client-side public-key authentication (like what ssh is doing, TLS also has support for it). That would make brute-force attempts essentially unfeasible.