alpha1beta

Two things to consider - check out Pressable or another dedicated WP Host. If you’re over the price for shared hosting, they’re competitive with Dedicated/VPS + addon backup solutions. They have a ton of caching built in, plus hourly backups. But it’s not for everyone.

One thing with the CDN considerations - where’s your audience? Local like in or around one city? Or local as in one country. The wider the reach, the more a CDN is beneficial. It doesn’t sound like it would help a lot. But it can also offload storage and the load of serving those requests.

To add what others said - Caching. You could do it on site and add Cloudflare on top of it. But you’ll probably want to add a few custom rules to cloudflare like Geo-restriction + no caching on /wp-admin/. Cloudflare also has anti-bot tech.

Beyond that, I’ve been waging a war on bots for a number of reasons. One of the easiest ways to block them is to block ASNs if you use Cloudflare. If AI or bot traffic is a problem, read on. If not, don’t worry about any of this.

If you want to block IP ranges yourself in Apache/nginx, your firewall, or your VPS provider’s firewall, start with looking up IPs in Amazon and Microsoft’s IPs (Like as listed here: https://ipinfo.io/AS16509) and start with the largest ranges.

With one line you can block 4.1M IPs from Amazon: 3.0.0.0/10 - start with these and go down to /16 and in a few hours you’ll kill access to tens of millions of bots.

You can also block by user agents.

I’m happy to share some Apache Rules/files if it would be helpful.

My theory on blocking is simple: I try to block as much as possible as far from the application layer at possible. It costs the most, in computational resources you pay for, to add a firewall inside of WordPress, like Wordfence. It also protects you the least. Blocking at Cloudflare and the VPS’s providers firewalls would be most efficient, followed by the firewall on the VPS, followed by an Apache/Nginx firewall, and then your application layer - WordPress. If you’re problems are mostly bot traffic, you want block as much bad traffic as possible without false positives.

Digital Ocean’s app platform offers a toer tier to deploy static sites from Github and a few other places.