In reply to Wiktor Sadowski.

I never look at my logs to see how many brute force attempts are being made against my sites. brute force attacks like spam and crawlers are the fact of life on the net and you need your site to be able to handle it if you are doing anything which is more then a simple blog.

The cheapest linode VPS I use for 10$/month serves me very well, and the only "DDOS" I ever experienced were due to actual higher traffic.

Of course I have basic performance enhancers like APC and object caching going on, but people that care about performance and security should not host on a shared hosting in the first place.

Actually comment spam is a much bigger DDOS threat as it requires a DB write which is much more expensive then a DB read required to authenticate a user, but I don't remember anyone suggesting to remove comments from core because business sites don't use them..... well, not yet ;)