Well sites usually hacked from comment forms and other forms .

Adding catpcha to all of them makes website safer . 

for captcha in comments on blog post you can use third party plugins . 

for security in login form please add google recpatcha keys in wp-admin -> vibebp-> settings .