I have many different attacks on my websites.
With these attacks, i have some mistakes from visitors when they log in.
To protect the sites, I block ip after 3 errors.
The problem is the following : when it's real attack, it's fine, but when it's a visitor, I have to unblock the ip manually (as the system cannot know what is a real hacker and what is a mistake).
However, some blocked attemps are always attacks, for example, the uploadshield, DFI, etc..
Is there a way to immediatly block the ip from some kind of attacks but leave for example 3 chances for people who can make mistake when they try to login ?