[Sn1F3rt]

Agreed with Dean, @Mashiro posted an awesome reply with a beautiful breakdown and technical explanation of all the OP desired. I do not have much more to add, however, I would like to highlight that Cloudflare has been my first choice of protecting my websites. It's free and does the job quite well. In fact, you could write a bash script that monitors your network and in case there's a way more than normal surge detected it uses the Cloudflare API to turn on the "Under Attack" mode for your website. That way you don't really need to always have the JS challenge for all your visitors to the website (it's quite annoying IMHO) while ensuring that you encounter an attack on your website successfully.

As for your last question, Akismet Anti-Spam is the plugin you are looking for, by far the most effective plugin I've come across to date. Hope that helps!