Devise has nice feature called :locakble. It locks when user has failed to login multiple times and sends email to recover it.
All of them works when I use webpages with Devise.
How to check password, make failed attempts and lock my user by using code?