@Jared - Hi Jared-- we do store the IPs as transients in the DB, yes.

Once BP checks the API to see if an IP is blocked, it then caches those results until the block expires, so you're not not calling out to our API every time wp-login.php is loaded.

For what it's worth, the IP check code is very lightweight, and, while we do access the DB, loading wp-login.php while blocked should be significantly lighter than loading a normal site page. We have no loop, no images, no bloat, just a single DB call. All told, that log in logic is under 40 lines of PHP

--
Sam Hotchkiss
Lead Developer
BruteProtect