best practices

hello just want to know if the default values are best practices?

i read a post here:

https://wordpress.org/support/topic/response-delay-tactic-depletes-php-processes

and i get no idea if my websites dont load after installing the plugin, as told on that post, i just know they load fine when i check, but i dont check them 24/7.

i know my websites got attack warnings every single day.
ip blocking is not an option to stop brute force, cause the attacks comes from multiple ips.

but they always use the username “admin” is there anyway to block users based on this username?

or make them not deplete processes?