My personal design style is that I only put application-layer protections in the application -- e.g. backed off timeouts for authentication failures, etc. Network level stuff I leave up to the OS or a dedicated proxy or hardware firewall. Good firewalls -- heck, even the Linux kernel -- can in fact do some fairly impressive analysis to fairly handle incoming connections and block abuse.
Any decent data center or hosting provider should be pleased to rent you the opportunity to sit behind a very nice and very smart firewall, if your application requires high availability. If you don't require high availability and your application isn't high-profile or controversial, the risk of DDOS is low -- there are more attractive targets to harass. - R
