This is an example source code for device cookies in PHP from the OWASP document "Slow Down Online Guessing Attacks with Device Cookies".
This source code is not a ready to work. You have to modify things and implement to match your code & DB.
It is made for testing but you can use it for any purpose under MIT license.
It is required at least PHP 7.0
Import the .sql file into your database, change configuration in config.php file.
Browse to form.php page and enter email: admin@localhost and password: pass. It should be displaying that you had logged in successfully.
Try again with wrong password until you get lockout.
For more test and information please continue reading on the OWASP page.
For generate random secret keys online.
link 1, link 2, link 3
For checking that generated keys is in the length you want.
link 1, link 2, link 3