I have a Plone site where Anonymous can use invokeFactory (in a specific folder). I'm afraid of DDoS attacks. What can I do?

I have a Plone Site where anonymous u开发者_开发百科sers create a "Subscription" object for a conference.

Fact is: a malicious user can call this screen a lot of times and crash my site. I can use a captcha to avoid it, but I would like to use it only after "x" attempts of the same user, something like the SO approach when a user tries to post a lot. Is there a module that does this for me? Show a recaptcha after a user tries the same url too many times?

For a start content in not the solution to everything. In your case having a custom content type for handling subscriptions seems like an overkill. Always ask yourself if what you are doing is really content-ish. Does it need to be contained, navigable, searchable whatever else content can be? For a conference subscription definitely not. In brief you could:

1. Create a form and save its data in lighter objects than full content or use sql.
2. Use Products.PloneFormGen, which also has captcha support.

Concerning the captcha if you go the manual way and create everything yourself, you could use cookies to "remember" visits. See How do you get and set cookies in Zope and Plone?

It's obvious that your system is subject for manipulations in form of mass-registrations in every way without further measures like a captcha or additional email validation after submission of the registration form. But this is independent of flow control, DDOS etc.