This worked great for me

I run three websites and each was getting visited by thousands of bots per day. At one point this was using up 95% of the server resources.

This plugin cut out all that traffic – and over the period of a few days it went down from about 1500 blocked bots per day per website, to about 20 or 30. They really do give up when they start getting 404s and 403s for everything.

I also changed the name of my WordPress login page using “WPS Hide Login” and that cut out hundreds of attempts at hacking into the site by not leaving the default login page as “wp-login.php” which is publicly-known. I was able to turn off the “Limit Login Attempts Reloaded” plugin because nothing knows the login page name, so I get no failed logins.

Now my CPU usage sits near zero most of the time and everything runs much more smoothly.