sleep

re: "mitigating the chances of a full bruit force attack by a limit of 30 lookups a minute."
Not really - the attacker could do 100 requests. Each request might take 2 seconds but it doesn't stop the number of requests done. You need to stop processing more than one request every 2 seconds rather than delay it by 2 seconds on each execution.

Note: The set_time_limit() function and the configuration directive max_execution_time only affect the execution time of the script itself. Any time spent on activity that happens outside the execution of the script such as system calls using system(), the sleep() function, database queries, etc. is not included when determining the maximum time that the script has been running.

Maybe obvious, but this my function to delay script execution using decimals for seconds (to mimic sleep(1.5) for example):
<?php
/**
 * Delays execution of the script by the given time.
 * @param mixed $time Time to pause script execution. Can be expressed
 * as an integer or a decimal.
 * @example msleep(1.5); // delay for 1.5 seconds
 * @example msleep(.1); // delay for 100 milliseconds
 */
function msleep($time)
{
 usleep($time * 1000000);
}
?>

You should put sleep into both the pass and fail branches, since an attacker can check whether the response is slow and use that as an indicator - cutting down the delay time. But a delay in both branches eliminates this possibility.

To avoid using usleep function that is not working on every operating system, below a function that should have the same behavior :
function wait(int $millisecond = 0) {
 if (0 !== $millisecond) {
 $seconds = (int) ($millisecond / 1000);
 $nanoSeconds = ($millisecond % 1000) * 1000000;
 time_nanosleep($seconds, $nanoSeconds);
 }
}

Diego Andrade's msleep function is not compatible with php7's `strict_types`, cast the usleep parameter to int, and it will be, 
 usleep((int)($time * 1000000));

From my testing calling sleep(0); will do a `thread spin`.
It would be nice if this was to be put explicitly in the documentation as it is useful. You can do the minimum wait without overloading the CPU thread.

it is a bad idea to use sleep() for delayed output effects as
1) you have to flush() output before you sleep
2) depending on your setup flush() will not work all the way to the browser as the web server might apply buffering of its own or the browser might not render output it thinks not to be complete
netscape for example will only display complete lines and will not show table parts until the </table> tag arrived
so use sleep if you have to wait for events and don't want to burn to much cycles, but don't use it for silly delayed output effects!

If you are having issues with sleep() and usleep() not responding as you feel they should, take a look at session_write_close()
as noted by anonymous on comments;
"If the ajax function doesn't do session_write_close(), then your outer page will appear to hang, and opening other pages in new tabs will also stall."

I wrote a simple method for sleeping with a float, which also allows you to do milliseconds (via fractional seconds).
<?php
 function sleepFloatSecs($secs) {
 $intSecs = intval($secs);
 $microSecs = ($secs - $intSecs) * 1000000;
 if($intSecs > 0) {
 sleep($intSecs);
 }
 if($microSecs > 0) {
 usleep($microSecs);
 }
 }
?>

And testing on my machine it works perfectly:
<?php
 $x = [0.100,0.250,0.5,1.0,1.5,2.0,2.5];
 foreach($x as $secs) {
 $t = microtime(true);
 sleepFloatSecs($secs);
 $t = microtime(true) - $t;
 echo "$secs \t => \t $t\n";
 }
?>

Output:
<?php
 0.1 => 0.10017800331116
 0.25 => 0.25016593933105
 0.5 => 0.50015211105347
 1 => 1.0001430511475
 1.5 => 1.5003218650818
 2 => 2.000167131424
 2.5 => 2.5002470016479
?>

An example of using sleep to run a set of functions at different intervals. This is not a replacement for multi-threading, but it could help someone that wants to do something cheap. You don't have to use eval(). It is just used as an example. This is different than running a standard 1 second sleep loop, due to sleeping longer does not consume as much CPU.
<?php
// current time
echo date('h:i:s') . "\n";
// Some example functions
function function_a() { echo 'function_a called @ ' . date('h:i:s') . PHP_EOL; }
function function_b() { echo 'function_b called @ ' . date('h:i:s') . PHP_EOL; }
function function_c() { echo 'function_c called @ ' . date('h:i:s') . PHP_EOL; }
// Add some timers (in seconds) with function calls
$sleeptimers = array();
$sleeptimers['5'][0]['func'] = 'function_a();';
$sleeptimers['10'][0]['func'] = 'function_b();';
$sleeptimers['15'][0]['func'] = 'function_c();';
// Process the timers
while(true) {
 $currenttime = time();
 reset($sleeptimers);
 $mintime = key($sleeptimers);
 foreach($sleeptimers as $SleepTime => $Jobs) {
 foreach($Jobs as $JobIndex => $JobDetail) {
 if(!isset($JobDetail['lastrun'])) {
 $sleeptimers[$SleepTime][$JobIndex]['lastrun'] = time();
 if($SleepTime < $mintime) $mintime = $SleepTime;
 } elseif(($currenttime - $JobDetail['lastrun']) >= $SleepTime) {
 eval($JobDetail['func']);
 $lastrun = time();
 $sleeptimers[$SleepTime][$JobIndex]['lastrun'] = $lastrun;
 $mysleeptime = $SleepTime - ($currenttime - $lastrun);
 if($mysleeptime < 0) $mysleeptime = 0;
 if(($currenttime - $JobDetail['lastrun']) < $mintime) $mintime = $mysleeptime; // account for length of time function runs
 echo 'Sleep time for function ' . $JobDetail['func'] . ' = ' . $mysleeptime . PHP_EOL;
 }
 }
 }
 echo 'Sleeping for ' . $mintime . ' seconds' . PHP_EOL;
 sleep($mintime);
}
?>