Hacker News Reader

You can block whole countries with the free CloudFlare tier. (Or give them CAPTCHA style challenges)

Can you now? A while ago it's possible to block countries in the free tier, but it was a bug and they reverted.

Wouldn't they just use a VPN to go around the block?

Look into ASN blacklisting.

Your site should be very important that everyone tries to hack it.

So long as it has any sort of registration and hence user accounts, it's good enough to top up password lists.

No, it does not have any registration or user accounts.