I know there is a tactic to secure login forms via checking and storing the failed login attempts, but do I need to protect my sign-up form in the same way? (Is it a stupid idea to log sign up submissions and ban ip-s if someone sends too many requests?) Will someone "spam register" my sign up form? Is it a common attack?
At first i was thinking about using ReCaptcha, but many sites says it's not necessary in this case and it's very annoying for normal (human) users.
My second thought was a database table: storing user ip-s and sign up attempts, to prevent too many registrations, but it's not 'too much' security? (My main concern about this is the constant database checking/writing process because it uses resources)
PS: my system send an e-mail confirmation request before letting users in, but still not confirmed users will be registered in the database so (if i want to) i can register hundreds of fake users (with some kind of a automated program) just for fun which is bad.