Have you considered using fail2ban instead of .htaccess and PHP?
Like fail2ban crawls your access log, sees a request to /honeypot and adds the IP to its banlist.
I have something similar running, if you try to login in my nextcloud too often you get fail2ban-ed too (instead of nextcloud disabling the user account which inconveniences me). Required forwarding the nextcloud logs to the nginx LXC but that works fine too...