Mitigate brute force attacks on login page

[eluser]skunkbad[/eluser]
Well, in terms of my current authentication system, I don't totally deny access, but instead allow them to see a lock-out message. In the case of a bot that is hammering away on the login, I think I may implement a solution such as denying by dynamic changes to the .htaccess. It would be easy to do, and I think you're right about lower system resources. I'd love to have my own server, but the only one I ever had was just a converted desktop computer, and I'm really not qualified to be a system admin.