Your best bet is to install a web application firewall like mod_security and apply rules to nip this in the butt. Apply Duo Security, to disallow unvalidated sudo commands from a compromised account.
- Configure the system to alert you upon logins (e.g. per mail in sshrc and bashrc)
This becomes too cumbersome and complex if you have systems that perform maintenance, e,g, SNMPv3, any kind of rsync accounts, etc. A better mechanism would be an alias of the last command written to terminal whenever you log in. Duo will stop a lot so check it out.
Let your firewall drop connections with obvious attack patterns. (e.g. http://spamcleaner.org/en/misc/w00tw00t.html)
This is not a feasible mechanism and you'd have to create a whitelist in parallel. Consider the fact that I can spoof connections pretending to be anyone. Imagine I generate enough spoofed messages to simulate say a CIDR /16, /8, or even /2.
Install PHPIDS (https://phpids.org/)
Unless you're willing to become an incident response analyst, you will be wasting so much time chasing false positives, you'll eventually ignore the alerts from IDS' and IPS' even well trained DFIR people spent hours at a time constantly modifying. Let alone someone who isn't accustomed to using an IDS, nor interpreting its output.
As for other recommendations, you need not block entire ranges for a webserver if you configure a WAF properly. On one of my sites, I PURPOSEFULLY keep Joomla 1.5 running and worry nothing about compromises since my WAF is written to only allow a POST from my static address. Its simplicity at its finest. My website is designed ONLY to allow GETs not POSTs so there is no need to go bezerk on rules.
You need to also be cognizant, that much traffic is generated by infected machines, so you're not stopping or blocking an attacker per-se, you're blocking one infected machine. So I wouldn't go as far as blocking entire IP blocks to a webpage. Mailserver, ssh server sure. In fact, you should have a default "BLOCK ALL" to your webserver, ONLY allowing your address to services such as SSH. However, everyone's designs/needs differ