How to stop the bots from trying?

I run a couple of specialist crossword solving websites. They're both custom PHP throughout, but that doesn't stop nefarious bots from trying to access what would normally be Wordpress or Joomla pages - looking for ways to infect blogs and forums.

I get lots of hits like this: ...../word/index.php?option=com_registration&task=register

I had a little difficulty in dealing with this because the part of the url after /word, is used as parameter to run a query, so in theory anything is valid. For example, if a visitor wanted to know about the word "friend" they'd be directed to /word/friend.

I have changed my php so that if a search term ends in .php, .html, .aspx etc I return a 404 error but the dumb bots just keep trying anyway.

They aren't using up a massive amount of bandwidth, or affecting delivery of my services but they do appear all of the time in my analytics which I use to react to searches and make sure I'm carrying the correct answer.

Is there any more I can do?