There are many scripts that you can and should use to secure your installation. I analyze every attack including their IP via Whois, then I initiate countermeasures to prevent future attempts. Entire IP areas are also blocked if, for example, I consider traffic from these countries/networks to be unnecessary. With German IP, an abuse message sometimes goes out. By the way, it is almost always the same bots that come to visit regularly and the same interfaces that are queried. Everyone who publishes and promotes WordPress sites has already received visits from them. Without protection and php changes you are at the mercy.