title: protect brute force attack mod security
body: <p>The login service of my application is attacked by being brute login and password enumerating. I want to use Apache <code>mod_security</code> to stop these attempts but the rule I put in place is not successful:</p>
  
  <pre><code>&lt;LocationMatch ^/api/login&gt;
  # Initalize IP collection with user's IP address
  SecAction "initcol:ip=%{REMOTE_ADDR},pass,nolog"
  # Detect failed login attempts
  SecRule RESPONSE_BODY "password is invalid|username is invalid" "phase:4,pass,setvar:ip.failed_logins=+1,expirevar:ip.failed_logins=60"
  # Block subsequent login attempts
  SecRule IP:FAILED_LOGINS "@gt 3" deny
  &lt;/LocationMatch&gt;
  </code></pre>
  
  <p>When testing with <code>POST</code>requests I still get the response "password &amp; username is invalid".</p>
  
  <p>How can the rules above be changed to stop repeated attempts to login?</p>