In reply to alex.

Alex, but those people do not intend to DOS you, they gain nothing from it.
People that do DDOS do it for extortion or some political reason and are totally not interested in spamming the comments or hacking your site in a way that will not be immediately discovered and therefor don't need proper login.

And 1% is still just 1% no matter from which number you take it from small or big. If you are doing shared hosting style of thing then you need to be able to handle traffic spikes in one of the sites (they sent a newsletter) without impacting the others and must have the spare capacity ready or at least a plan on how to handle such situation.

Comment spam is a problem because akismet writes to the DB. Akismet should really be the last line of defense and not the first one. But brute force attacks? Most of the cures are worse than the decease. From experience, even mediocre passwords can stand them.

And as for not wanting to pay for more hardware, I don't think that 10$ more a month is excessive to anyone that has a web site, if the site important enough for him, but what is lacking in your comment is a solution. What exactly do you propose that will work under all server configurations and will reduce brute force attempts and spam?