Thanks for the info, @wfpeter. I will immediately change a few settings in my Brute Force Protection options.
Has my site been penetrated if I see Response code 200 and 301 in Live Traffic report? If it has, should I delete my Virtual Machine instance and create a new one, or changing my site IP address is good enough? I don’t know much about WordPress.