Support

You are confusing a whole lot of things and based on your subscription history you went to WordPress from Joomla. I see that it may have tainted your expectations. Let's try to take things one at a time and see why a WordPress site taking 40 seconds to load may not even be caused by something external...

Accessing the /admin URL on a WordPress site redirects you automatically to /wp-admin which redirects you automatically to wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1 where www.example.com is your site.

The initial redirection takes about 0.6 seconds on a default (empty) WordPress installation and a run of the mill server — on the same server a default installation of Joomla 4 takes under 0.3 seconds which tells you just how slower WordPress is from the get-go.

The more plugins you have in WordPress the longer it will take to load. Plugins in WordPress are loaded and execute in every single page request. I know that you are used to Joomla components only loading in specific pages and plugins being very lightweight. This is not the case in WordPress. WordPress' plugins are a combination of what Joomla would call modules, plugins, components and libraries. Considering that WordPress is missing a ton of basic features (e.g. being able to send emails over SMTP, a contact form, SEF/SEO, ...) and you need to load several dozen plugins to implement them those 0.6 seconds quickly become 2–4 seconds. Add something heavy like a page builder and/or e-commerce and you have 10 second page load times.

Of course the heavier the page is the more server resources it takes. Your server, for each and every page load on your site, needs to open a lot more files, run a lot more code and perform a lot more database queries. This doesn't happen on a properly architected CMS like Joomla which only loads and executes code when absolutely necessary. Anyway, back to WordPress, the way it runs reams of code with reckless abandon ends up consuming the CPU, memory and I/O resources of your server, possibly also causing a lot of swap activity as well (since servers are typically RAM-restricted, another point where WordPress is worse than Joomla by a factor of 10 in most real world sites), which leads to increased iowait. At this point your server suffers because it cannot get enough time to perform I/O. This causes the page load times to spiral out of control. In these cases you typically see a relatively tame CPU usage and a high load average with a very high iowait percentage. The only solution to that is either going for a beefier server with I/O and memory capacity to waste or a CMS which doesn't waste as many resources as WordPress.

Using Admin Tools will help, but not as much as you'd hope. For sure, it will auto-block a lot of the repeat visits to /admin (credentials stuffing and brute forcing bots), If you use the Optimise WAF feature the IP blocking will take place before WP loads any plugins so at least these requests won't contribute to the high load of your server. However, if you are talking about less than 100 of these requests per hour the resource you save will be nowhere near enough to make any meaningful dent to your site's abysmal performance.

You could additionally try install Yet Another Plugin, this time for caching, and/or use something like CloudFlare to reduce the number of requests actually hitting your server. Again, this is not guaranteed to make much of a difference if much of your site is not static, e.g. if you have server-side generated HTML per user / visitor of your site. Reading between the lines that might be the case, as you see to have an e-commerce site.

So, the solution to your site's woes would be either a beefier server or a different CMS. WordPress is not a fast CMS. WordPress was faster than Joomla 1.0 as default (blank) installations without any data and people still refer to that misleading point of data from 17 years ago! Even back then, real world sites with Joomla were faster than WordPress — unless you started comparing apples to oranges, e.g. a blog site made with WordPress with an e-commerce site made with Joomla 1.0 and VirtueMart, the latter of course being slower as e-commerce sites tend to be due to the extensive use of database data! Talking about real world sites, already back in 2007, Joomla 1.5 was marginally faster than contemporary WordPress and slower than Drupal. Joomla 3 was quite faster than WordPress and in par with Drupal. Joomla 4 is so much faster than WordPress it doesn't even make sense comparing the respective site speeds — and it's become faster than Drupal, too. Third party software in Joomla has gotten faster, but not in WordPress where there is at the very least a massive bottleneck in the shape of how it stores configuration data for plugins (a database design that was already considered bad and obsolete in 2007!).

Now you have enough information to make an informed decision about what to do with your site.

Yeah, an empty site like that, even with a heavy theme (I haven't used yours, I don't know if it's heavy) wouldn't take more than 2-4 seconds on a mid-range host. 40 seconds is way too much and says that something is wrong with the hosting or the network connection.

So, you do have hundreds of these requests per hour?! I think at this point you need to invest in a CloudFlare subscription. They will prune these incoming junk requests before they hit your server. You should still use Admin Tools for the protection features which rely on knowing the application state but at least you won't have the server to deal with junk requests.