Can't you offer it on a non-default port? Isn't brute force attempts on PMA web UI just the same thing as brute force attempts on MySQL directly? MySQL has built-in features to block IP addresses that make too many bad attempts, as well...
The PMA webUI is always going to be much slower, even if the database is performing quickly, because it runs additional queries needed to populate the UI screens, dropdown menus, etc. that a desktop client like MySQL Workbench would only need to run once instead of repeatedly on every page load. It's definitely not as feature-rich as a desktop client, either.
