Hi Jeff,

Regarding "low hanging fruit" - I believe its best to prevent spambots identifying your site in the first place. I couldn’t find advice on this when I started blogging, so I did my own research. If anyone is interested I’ve written a post about how these bots use “footprints” to find your site (and how to foil the bots).

I also think password protecting wp-admin directory is a simpler & more effective starting point than 2 -factor authentication for small sites. A friend was suffering burst mode DDOS attacks on wp-login, bringing his site down even though he was using the limit logins plugin. We solved this by password protecting the admin directory - drastically reducing server load/bandwidth i.e. no PHP/Wordpress scripts run and no returning an HTML “page”; just a few bytes HTTP response. With 2 factor authentication plugins you still have the server load and bandwidth issues – and they only protect login from hacking.