How do you defend a login endpoint against brute force and credential stuffing?

Use MFA, rate limits on several keys, breached-password checks, risk-based challenges, monitoring and generic error messages. The defences must cover two different attack patterns:

• Brute force tries many passwords against one account.
• Credential stuffing replays username and password pairs leaked from other sites. Each account sees only one or two attempts, often from many different IPs.

The defences:

• MFA (multi-factor authentication, such as a code from an app) is the strongest defence. A correct password alone is no longer enough to log in.
• Rate limit on several keys: per account, per IP, and per IP range or device. Use delays that grow with each failure, not permanent lockouts.
• Screen passwords against lists of breached passwords at signup and at password change.
• Show a CAPTCHA or another challenge when risk signals appear, such as a high failure rate.
• Monitor for login spikes and high failure ratios, and alert on them. Notify users about logins from new devices.

Keep error messages generic, such as "Wrong username or password". This way attackers can't confirm which usernames exist.