@amy @mhoye unfortunately once you have your wp up and running, and especially if your site is well ranked by the search engines... that's when your problems start i.e. the bot invasion starts.

after my server got hacked from an out of date plugin in 2015 i got a bit obsessed with this subject and wrote a thing where all my sites work together to protect key endpoints and it seems to have been quite effective (still running, so far 0 hacks and eliminates 99.9% of spam signups).. which was especially relevant in a hostile environment like sexwork and it became something of a USP of my 'hosting'. it could even identify & silently redirect hostile traffic to a severely rate limited vhost (e.g 0.1kb/s) where returning a 100kb animated gif would take ages and quickly "slow loris" logjam attacks over proxychains.

i have no idea how others deal with it tho bc jetpack, cloudflare & wafs like wordfence never really seemed to do much and that stuff was *draining*.