How do you block suspicious visitors & reduce API calls on WordPress sites?

If you're running WordPress on your hosting setup and want to cut down on suspicious traffic or bots hammering your login/API endpoints, these free plugins can really help:

Wordfence Security: Great all-around firewall and login protection.
WP Cerber Security: Clean UI and very effective at blocking brute force attempts.
Limit Login Attempts Reloaded: Lightweight, does just what it says: throttles failed login attempts

Just curious to know what tools you all are using, especially if you're on shared hosting or a small VPS with limited resources.