how to handle failed login attempts?

web password is commonly used in many web applications that require
authentication. The question is what should the system do if there are
multiple consecutive failed authentication attempts with a valid
username but incorrect password? Should the system lock the account, or
don't do anything?

I tried several famous email accounts and entered the incorrect
password on purpose, but they didn't lock the account.

please discuss. thanks!!

.