private function count_attempts( $ttl = 300 ) {

		if ( isset( $this->attempts ) ) {
			return;
		}

		$this->sniff_ip();
		$ip = $this->ip_data[ 0 ];

		$attempts = get_site_transient( self::TRANSIENT_NAME );
		is_array( $attempts ) or $attempts = [];

		// Seems the first time a failed attempt for this IP
		if ( ! $attempts || ! array_key_exists( $ip, $attempts ) ) {
			$attempts[ $ip ] = [ 'count' => 0, 'last_logged' => 0, ];
		}

		$attempts[ $ip ][ 'count' ] ++;
		$this->attempts_data = $attempts;

		$count       = $attempts[ $ip ][ 'count' ];
		$last_logged = $attempts[ $ip ][ 'last_logged' ];

		/**
		 * During a brute force attack, logging all the failed attempts can be so expensive to put the server down.
		 * So we log:
		 *
		 * - 3rd attempt
		 * - every 20 when total attempts are > 23 && < 100 (23rd, 43rd...)
		 * - every 100 when total attempts are > 182 && < 1182 (183rd, 283rd...)
		 * - every 200 when total attempts are > 1182 (1183rd, 1383rd...)
		 */
		$do_log =
			$count === 3
			|| ( $count < 100 && ( $count - $last_logged ) === 20 )
			|| ( $count < 1000 && ( $count - $last_logged ) === 100 )
			|| ( ( $count - $last_logged ) === 200 );

		$do_log and $attempts[ $ip ][ 'last_logged' ] = $count;
		set_site_transient( self::TRANSIENT_NAME, $attempts, $ttl );

		$this->attempts = $do_log ? $count : 0;
	}