Humans never visit but I have some websites with ancient cms's. When I got bored playing with them I download the html, change the extensions to php and replace the site with a static copy. People then tirelessly try to hack it since they have laundry lists of known vulnerabilities. (Now that I think about it I regret not making the admin area public for added nostalgia.)

Could be because of number of pages you have. At work we have several million public content pages, so a few badly behaving bots can already do a lot of damage.

For my personal website it’s 10x more bots but I barely notice because it’s a few pages.

Get a letsencrypt cert, I always get a massive wave of vulnerability probers after renewing.

I don't even have a domain name and I'm getting lots of hits.