To avoid bruteforces, bots and so on, I would recommend to use Cloudflare or something similar. Since this limits the requests on the network side and not in the app. Creating policies for bruteforces in the app will anyway use your resources (cpu/ram).
2 Likes