In reply to Wiktor Sadowski.

What, "they" can't hammer your posts, comment handlers, search handlers, archive pages, etc. with cache-busting URL parameters, stuffed HTTP headers and long POST parameters, to ensure that PHP and the database are called, and tie up resources that way?

DoS attacks don't require a login "door," they just require keeping you busy.