Lots of good answers already. Just want to add. Block IP from every country that doesn't have your users in it. That will go a long way.