Our firewall is pretty sweet and helps prevent problems from DDOS attacks.
We go into detail about it over here:
https://docs.wordfence.com/en/Wordfence_options#Firewall_Rules
We have several settings there that let you decide how much traffic for an IP is too much. You can outright block the traffic after a certain number of hits in a minute or, if you are feeling charitable, you can choose to throttle it which slows the request down. I used a combination of both on the production sites I have managed.
Example
If you have any other questions about it, let me know.
tim
