Thank you, I have resolved the issue but not 100% certain of the cause. I think it was because my site was recently moved to a new server, I replaced the .htaccess file with a clean one and the issue seems to be resolved as brute force now enables! 
Satying this the Ithemes securtiy check is still throwing an Invalid IP response though so something still isnt right. Loopback is working and also mod_rewrite.
Anyway thank you for your time and for providing a great plugin!
