Thank you, I have resolved the issue but not 100% certain of the cause. I think it was because my site was recently moved to a new server, I replaced the .htaccess file with a clean one and the issue seems to be resolved as brute force now enables! š
Satying this the Ithemes securtiy check is still throwing an Invalid IP response though so something still isnt right. Loopback is working and also mod_rewrite.
Anyway thank you for your time and for providing a great plugin!