You could add bot/DDOS protection.

Rate limit per IP + country blocking (GeoIP integration).

Temporary "Maintenance Whitelist" mode: during mass attacks, only allow those who have already joined.

"Light" challenge: like mandatory movement before chatting/attacking, useful against stupid bots.

Show the processing process.