In reply to alex.

Mark,

"Bootstraping wordpress has almost the same cost to whatever page you load. So having 1% of your site traffic directed at the login page should not be a big thing. If the site can not handle a spike of 1% in traffic then it is next to needing an hardware upgrade and blocking the login will not really change that."

For a VERY large single site, the percentage might be small. For smaller sites, however, the numbers are different. When you have a server that hosts hundreds (or thousands) of small wordpress sites, a high power spammer with a big connection can be absolute death. I am not talking about some guy doign a copypasta manual job with comments, but hardcore bots that can hit your sites with a 10-50meg a second assault on your server. They can literally eat up all system resources and create a virtual DDoS in seconds. The longer you leave them connected, and the longer you give them enough response to keep trying, they will absolutely bombard you.

I looked at one case this morning (in real time). Blocking a SINGLE xmlrpc bot was enough to take a full 1 off the server load - which is load enough to handle hundreds if not thousands of regular requests a minute. That is with sending them nothing more than a 404.

I suggest you relook at your sites carefully. I think you would be shocked to see how many times your door gets knocked, how often someone tries to log in without permission, how often spammers trying to directly call wp-comments or xmlrpc. For a small to mid site with say 1000 session a day, the spam and attack traffic can easily match or exceed normal users. It's twice the resources for nothing.

The old "throw more hardware at it" is generally a poor answer, that is money down the toilet similar to making a new pot of coffee every time someone takes a single cup.