Cyberkillen

I would use something like cloudflare pages or an Azure static web app. Its free and serverless you just update your site with github or similar.

Any screwdriver works if you try hard enough and don’t care about the screws afterwards.

Source: I opened up one of these with several wrong screwdrivers over the course of several hours.

I would have a look at your encryption mode on cloudflare, it could be set so that its trying to force https.

https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/

I had the exact same problem, doing this stopped all the login attempts.