In reply to alex.

"Good servers don't cost $10."

You have to decide who are you trying to protect here. For a big site the added brute force and spam are in significant in the amount of valid traffic they use.

For a small site a 10$ digital ocean or linode is way more then enough even for handling the brute force and spam. Making it 20$.... well it is not needed, maybe just just to sleep better at night if you are really paranoid.

I admined a site with 40M page views a month and brute force against the login was a total non issue, no one bothered to look at the logs. Now cache busting urls from whatever misconfigured server they came from (didn't look like an attack), that was a real big issue.