Please see this support article for various actions you can take to harden your website.
But understand that no security solution RUNNING ON YOUR SITE can prevent a bot or malicious traffic from hitting your site.
So if your goal is to prevent the this undesirable traffic from reaching your site to begin with, you’re going to need an external security solution that acts as a gatekeeper (Web Application Firewall or WAF) between your site’s visitors and your site, blocking out all undesired traffic from reaching your site. Examples of such WAF are Cloudflare (free), Sucuri (the paid service, not just the free plugin), WordFence Premium (again, the paid service, not just the free plugin), etc.
On the other hand, if you don’t care about the bot traffic hitting your website, but you only want to prevent a successful login or some other compromise, then you can use a security solution on the website, and any of the WordPress security plugins would be useful.
Ideally, you want to have both protections — as the bad traffic can slow down your website (and sometimes increase your hosting bill), even if login is successful.
Good luck!
Hardening WordPress
