Today the server went down after hundreds of requests came in for various pages within about 38 seconds. The offending IP address is already known on the net as a "comment spammer" though it cannot actually post here. Apache (the web serving program) already has settings to limit the number of requests it will try to service at one time, and today I've reduced that from 150 to 50. I'm not sure exactly what the optimal setting should be, but if it's too low I'll see warnings about the limit being hit. 150 apparently is never hit. If it is too low then the worst case scenario is a bit slower response time during peak activity. In time I should find the optimal setting.
Good chance though that no one will notice anything different, except perhaps fewer occurances of outages.
It's more ideal to set a limit on the number of requests from a single IP address that Apache would handle but I don't know yet if Apache has that ability.