[sschueller]

Or add https://coinhive.com which will put a load on the client and make you a bit of money.

Can be used like a captcha or placed in between a process. You just specify how many hashes need to be completed before proceeding.

[foepys]

Very bad idea. This might get your page flagged by anti virus scanners or even search engines.

[zerostar07]

If you manage to do it for only suspicious-looking login attempts, thats actually a great way to both stall them and benefit. it just feels so much win

but are these scripts sophisticated enough to run JS etc?

[foepys]

If you fail to detect a bad botnet once and show the mining script to an important crawler (like a search engine), and then land on a blacklist, it could potentially require a huge effort to get off it again. It's simply not worth the risk.

[x0]

Some of them can run Javascript, I'm thinking specifically of people who write scrapers in things like PhantomJS (headless browser, very very cool software).