As part of Piwik's multi-layered security approach, there are a number of areas which could detect possible attack and mitigate (e.g., block).

Scenarios:

• n failed login attempts (e.g., brute force)
• n failed lost password requests
• n failed password reset attempts
• password reset with invalid (e.g., expired) reset token (e.g., replay)
• n feedback requests within m minutes
• n API requests with invalid parameter
• API request with invalid token
• direct access to .php file
• request for non-existent file
• directory list attempt

Could optionally be extended to tracking requests with caveat that this would have some impact on performance.

Note: some of the above involves integration with the web server (e.g., Apache); I have no idea how doable some of this is with other servers (e.g., IIS, lighttpd, nginx, cherokee, jetty, tomcat, ...).