Manual:$wgPasswordAttemptThrottle

Details
Limit password attempts to count attempts per seconds per IP per address.