I do that as well, but nothing gets through anyways because I'm not running Wordpress or a version of Apache from 2012. I also have nginx set up to reject conne

I do that as well, but nothing gets through anyways because I'm not running Wordpress or a version of Apache from 2012. I also have nginx set up to reject connections without the expected 'Host' header, and that quickly bounces a few attackers. But many still end up getting all the way to a 404 or 400 for their attack URL.