Use Protect Remote to block “wp-admin” and “wp-json” for public access. It’ll protect your site permanently. If you have a problem with DDOS attack, you can also use CloudFlare