WordPress Bot Defense Setup

My WordPress site is attracting far too many automated hits, so I want to put firm but user-friendly barriers in place. The core of the job is to introduce solid login-attempt limitations—think IP-based throttling and timed lockouts—so a bot can no longer hammer the wp-login screen without consequence.

Alongside that, every public-facing form should gain a lightweight CAPTCHA layer. I need this active on the login page, registration page, contact form and the checkout flow so genuine visitors glide through while bots are stopped cold.

Deliverables
• Configure and test a reputable security plugin (Wordfence, Limit Login Attempts Reloaded, or a comparable tool) to enforce the new login-attempt rules.
• Add and verify Google reCAPTCHA v3 (or another modern, unobtrusive CAPTCHA) on the four pages listed above.
• Provide a short hand-off note explaining where settings live in the dashboard so I can tweak thresholds or keys later.

Once everything is live, a quick demonstration of failed bot attempts being correctly blocked will serve as acceptance that the work is complete.