title: PHP: Anti-Flood/Spam system
body: <p>I'm actually working on a PHP project that will feature a user system (Login,Register,Send lost password to email,..) and I think that this may be very vulnerable to Brute-Force attacks and/or Spam (Send a password to someone's email like 1000 times, etc. use your fantasy)
  .</p>
  
  <ul>
  <li>Do today's webservers (Apache, IIS) have some sort of built-in defense against Brute-Force?</li>
  <li><p>What would be the best way to implement an Anti-Spam/Flood system, if I e.g.: want a page not be able to be called more than two times a minute, however another page may be called up to 100 times a minute or so.</p>
  
  <ul>
  <li><p>I would definitely have to store IP adresses, the time when they last visited a page and the number of visits somewhere - but would it be efficient enough storing it in a text-file/database (MySQL)</p></li>
  <li><p>Should I use captchas for things like registering/recovering lost passwords?</p></li>
  <li><p>Are "text" captchas viable? (Something like "What is 5 plus 9 minus 2? ")</p></li>
  <li><p>The page won't be used by that many users (100-200), do I actually have to implement all these things?</p></li>
  </ul></li>
  </ul>