This question is off topic. To answer it, I would use the comment box, but this is too long..
cphulk is a service on cpanel servers that you might have. It does not monitor the logins to your personal scripts (ie: Wordpress). It monitors your logins to the services running on your server, like cpanel login, whm login, ssh, email (ie: smtp), and other processes.
It is absolutely necessary to thwart brute-force attempts at the script level for any moderate site. If it's your own personal little login page, no big deal. If you have thousands of members, then yeah you will want to. If your handling money, or anything that causes a concern for security, yes. If you have forms that let the user's upload to the server, yes. In most cases, yes you do and should.
Simply tracking the username/email and how many attempts isn't enough. Bots use proxies and rotate usernames/emails. They may use a list of 10k usernames and try 10 passwords only.. ie: 10 failed attempts per account, to fly under the radar, and thousands of proxies.
The best way is to protect both ways, by too many attempts by IP address (no matter the username tried), and too many attempts per account.
If an IP has tried to login to > 10 accounts in the past 60 minutes, block them for x minutes/hours.
If an IP has had > 10 failed logins in the past 15 minutes (no matter the account), block it for 15 minutes.
If an account has had more than 10 failed logins in the past 15 minutes, lock it for 15 minutes.
Keep another table for your IP block records. If they have been blocked more than say 3 times in the past 24 hours, block the IP for 24 hours.
You could move up, and repeat blockers, alert you to check it out so you can blacklist the IP.
Just some ideas, adjust the method/actions/times as you see fit.