In reply to alex.

Wordpress login - block by country/IP: Ineffective and potentially giving a false sense of security. If users rely on this, they are already letting hackers/bots from unwanted IPs get to a point where they cause Wordpress or other server side code to run, be it to attempt crack login, exploit known vulnerabilities, or run code to cause Denial of Service.

You mention that most sites are "single admin" - so why not password protect your client's wp admin directory? This will not only prevent the login script running, but is also highly effective in mitigating against many Denial of Service attacks as it only results in a response of a "few" bytes and NO server time processing Wordpress login or other "admin" scripts.

If you must restrict by IP then, as you mention has been suggested to you - do it at the perimeter gate, this means htaccess (for most) . If you want to do it for selected countries you can use either country IP range deny OR allow blocks, and 403 before any scripts are run. If you're using Cloudflare then you can tell Cloudflare which countries to block saving your resources