Comment by vincent_s

That's why I suggested blocking requests at the web server level so they don't even reach PHP.