On my WordPress site, I had Wordfence installed, along with Cloudflare. Still, every day I used to get at least 10-15 spam messages every day!!
Then installed the Ultimate Security plugin (https://wordpress.org/plugins/ultimate-security) changed my login URL, installed Turnstile on my WordPress comment forms. Wow!
0 spams for the last 4 days!!!