Manual:$wgPasswordAttemptThrottle

Details
Limit password attempts to count attempts per seconds per IP per username.

$wgMainCacheType must be set to something other than   for this setting to work.

To disable, put the following in LocalSettings.php: $wgPasswordAttemptThrottle = false;

Multiple thresholds can be added; they will all be tested separately.