Your site mentioned "Bot Protection" as one of the feature. I was wondering whether this is just for login form (brute force bot?) or affect the whole site (for example tracking bot or other bad bots)?

Just for the log in form. You can block bots from accessing the login page entirely. But they'll be able to access the site.