Manual:$wgPasswordAttemptThrottle/de-formal

Details
Limit password attempts to count attempts per seconds per IP per username.

must be set to something other than  for this setting to work.

To disable, put the following in LocalSettings.php:

Multiple thresholds can be added. They will all be tested separately.